Hi, Not to mean to be nitpicking, but the original syslog man pages state that priority is defined to be: priority ::= facility . level So shouldn't the config semantics be: filter f_messages { ( level(info) or level(notice) or level(warn) ) and not facility(auth) and not facility(authpriv) and not facility(cron) and not facility(daemon) and not facility(mail) and not facility(news); }; or better yet, filter f_messages { level(info,notice,warn..crit) and not facility(auth,authpriv,cron,daemon,mail,news); }; L L Richi Plana 8^) ,-,-. ,-,-. ,-,-. ,-,-. ,- LL LL Systems Administrator / / \ \ / / \ \ / / \ \ / / \ \ / / LLLLL Mosaic Communications, Inc. \ \ / / \ \ / / \ \ / / \ \ / / LLLLL mailto:richip@mozcom.com `-'-' `-'-' `-'-' `-'-' ------PGP key http://www2.mozcom.com/~richip/richip.asc ----------------