Stephen, Sure there's a way. Syslog-ng is a full service application after all. You want to set up a destination and a filter: destination mail { file("/var/adm/maillogs"); }; filter f_mail { facility(mail); }; log { source(src); filter(f_mail); destination(mail); }; log { source(src); filter(DEFAULT); destination(all); }; The DEFAULT is a macro that will basically log everything that hasn't already been logged. If you just didn't want your mail logs just set the file to /dev/null or something. There are probably other ways to do this but this seems the most straight forward to me. Regards, DRew -----Original Message----- From: Stephen C Burns [mailto:sburns@farpointer.net] Sent: Tuesday, July 24, 2001 9:42 PM To: syslog-ng@lists.balabit.hu Subject: [syslog-ng]Eliminating certain keyword from the "all" directive? Hi all, I have a question regarding the redirection of certain log messages to files. I currently have the "all" directive sending every syslog message into /var/log/messages, via: destination all { file("/var/log/messages"); }; And that is great, except I don't want my mail messages getting sent into the messages file as well as this takes up a lot of space. So I basically need some way to say "send all messages except for mail messages into /var/log/messages" Is there such a way? Thank you for any help!! _______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng