Hi, I'm trying to do some kind of load-balancing using syslog-ng. I'm willing to write to 2 different files named "syslog1" and "syslog2". The first one would get all messages received by syslog whose timestamp have a second ending with 0, 1, 2, 3 or 4. Syslog 2 would get all messages whose second ends with 5, 6, 7, 8 or 9. For instance, if I get those messages : Feb 27 00:00:03 blabla1 Feb 27 00:00:04 blabla2 Feb 27 00:00:05 blabla3 Feb 27 00:00:06 blabla4 The first two messages would end up in syslog1 and the last 2 messages would end up in syslog2 However, I was not able to do this because : * filtering is not possible on any date-related macro (I don't know why, but only MSG and MSGHDR macros seem populated at that point in time) * I can't apply a rewrite rule on $SEC * I can't apply any function to the $SEC macro in the destination statement, or I don't know how to do it Do you think it's still possible to achieve what I want with syslog-ng ? Vincent