Thanks for all the help. I had a restart of the server today and suddenly kspam triggered on the rules, dont know why yet. I added the KS_DEBUG switch, very informative, I guess it is not reccomended to have this enabled during normal operation, big overhead, large logs??