I am having some difficulty understanding filters. (syslog-ng 1.3.17) I am trying to replicate Solaris's syslog.conf entry: *.err;kern.debug;daemon.notice;auth.err;news.none;user.none as far as I can tell this translates to: filter filname { priority(panic, alert, crit, error) and not facility(user, news); }; which is also the same as filter filname { priority(panic, alert, crit, error) and not facility(user) and not facility(news); }; kern doesn't seem to be logging at all... if I drop facility checking then kern logs.... Any thoughts? Also I noticed that there is a range operator (..) but the above priority(panic, alert, crit, error) does not seem to be the same as priority(panic..error). Am I right in thinking that (..) is broken or am misunderstanding what (..) does. ---------------------------------------------------------------------------- __o Bradley Arlt Email: arlt@cpsc.ucalgary.ca o__ _ \<_ WWW: www.acs.ucalgary.ca/~bdarlt _>/ _ (_)/(_) -Eat well, sleep peacefully, drink lots, and ride like hell. (_)\(_)