Thanks for pointing out how a user can override the logging but do you have some suggested changes for capturing audit data? I'd like to be able to report on how much each user actually used SAS, what procs they use, and what databases and tables access.