I tried to post earlier, but it didn't get through. Anyway.... good work on this one. I appreciate this tool. I pulled numbers from my environment and we are getting an entry that shows the username and then one entry that shows no user name. So every device has two entries- one wiht a username and one that is blank. The one that shows no username is generating the same number of 4xxx errors as hits. We only use iPhones in our environment. Any idea why we would see the entry with no username associated to it, and how can we determine the actual 4xxx error that is being generated? Is is normal for an iPhone to generate a lot of 4xxx errors? Also, what qualifies as a "hit?" Thanks for the blog. It has helped me a great deal.