i am running ncsa logs....i see all of the strings that you mentioned (httpop/s, http/p5s, %to1KB, and it is configured via WATCH_WEB="-DWATCH_WEB" ...We have added a DWATCH-HTTPD to the line to see if that makes a difference(i did it just now, and waiting for results). do you have any other suggestions? Thanks, i really appreciate it.