Well.. < I happened to be reading someone elses question about field definitions and someone else pointed them to http://squid.nlanr.net/Doc/FAQ/FAQ-6.html And part way down the page I found. authuser Always NULL ("-") for Squid logs. And received the my shock for the day. Can someone please tell me if there is a way to NOT have this status? Part of our log analysis is to get data on which authusers hitting the WebServers have done how much during the month. It is also how we monitor for stolen passwords as an authuser total will be beyond the norm if many people are using it. To have NULL status is going to complicate our lives tremendously when it comes to keeping tabs on all the sites we host. James.