I think that the big missing part of the current logging system that makes it hard to use for auditing is that it does not link service tickets that are issued by the TGS to the TGT used to issue them. The other problem is that the format of the data cannot easily be parsed or stored in a database. --Sam