I checked out syslog.conf and did not see what to uncomment to add the passwd logging it currently logs bad logins and su but not successful changed passwds then I had a look at /var/log/security but nothing was in that file. hmm would I have to add a line to the syslog.conf file to log this type of activity? Thanks