Hi, One of our systems, running ARCH Linux, was compromised (a non-privileged account, fortunately). But, we could not find /var/log/auth.log or similar for investigation. Does the journal keep track of login attempts? It seems that ARCH does not run [r]syslogd. Best regards, Maxe kaasen at nuts-edu.no