Mike, try this...
SYSDIAG
LOGTOOL
SUMMARIZE LOG=3900/4000
E

change the 3900/4000 to your logfile number range which you can find with
'LISTF [log in to unmask] ,2'
This will show you subtotals of each event class,
from here you drill down further if you want,
 'LIST LOG=xxx/YYY; TYPE = (ONE OF THE TYPES FROM ABOVE THAT LOOKS SUSPICIOUS,
 LIKE SOMETHING WITH 10,000 ENTRYS..ETC...)
Good Luck


Jim Sanders
Is there Life after HP3000?