I've seen one commercial effort fail though the use of bugzilla (basically, the excessive detail required on input was a poor match for the project, without judging whether it is a poor match for other projects...) PRMS worked surprisingly well for us at Cygnus for years, but doesn't match all that well to other environments/cultures (and really it's surprisingly retro right now.) If your emphasis is on tracking, rather than "bug", bestpractical.com's open source "RT" is excellent and has a lot of high end commercial traction - I've argued, but not deployed, that request tracking and bug tracking are *different* things, that you have a different set of goals for managing the *report* of the problem (especially when it comes from a customer) than you do when managing the *defect itself* within the code. Unfortunately I haven't seen any systems that were especially good at the latter (imagine an enhanced cvs annotate with information about nearby bugs, and repository wide "defect-affinity" data, hmmmm.) Much of the resistance to systems like this seems to come from their use by managers as ways of tracking "defective developers" :-) Oh, and I'm also using a small one-user roundup instance specifically for security-issue tracking, mostly because it is zero-overhead to get started... odds are that I'll experiment there, develop a schema and a policy out of that, and then get the schema deployed within the organizationally-supported RT installation...