Hello, Actually, this is not a log analyzer issue. I am just wondering if the MySQL-way is better than simple files. Is there any discussion around? BTW, I use rsyslogd(rsyslog-3.22.1-3.el5_5.1) as log receiver. Thanks, Kaiwang