Dear friends, I followed this discussion a little bit, and here's my 2 cents: bash_history logs only commands one typed in bash. What if he changes to tcsh or whatever else? "Whatever else" includes also graphical helpers, like konqueror or nautilus that give you a lot of freedom to run or modify any files, while you can't log any actions... and tty sniffer won't help either. I agree with the statement that you don't have to let any intruder play with your machine, since it may well be that he HAS already installed sniffers (tty or network) and stuff like that, so any action you take now will be well known to him. So better really unplug the network, shut off the machine, boot from CD (if you'd like to trace back changes he made to your system), and reinstall... Good luck, Eduard __________________________________ Do you Yahoo!? Yahoo! Calendar - Free online calendar with sync to Outlook(TM). http://calendar.yahoo.com