@Clive_A I might be missing something here, but wouldn't it be a lot simple to have an option to report those entries by source IP address instead so that we can troubleshoot this remotely as well...