Hmm I'm stuffed up I guess, but I can't work out where... Please help!!! Thanks, Bret Here is my syslog-ng.conf file options { sync(0); time_reopen(10); log_fifo_size(100); }; source local { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; source net { udp(); }; destination all { file("/var/adm/messages"); }; destination vpn { file("/usr/log1/vpn.log"); }; filter f_vpnhosts { host("203.126.246.216") or host("203.126.246.217") or host("203.126.246.218"); }; filter f_vpnhosts2 { host("10.84.3.10"); }; log { source(net); filter(f_vpnhosts); destination(vpn); }; log { source(net); filter(f_vpnhosts2); destination(vpn); }; log { source(local); destination(all); }; log { source(net); destination(all); }; Here is the log lines I'm trying to re-direct to the vpn.log Nov 7 08:15:55 10.84.3.10/10.84.3.10 [1:33947706:Gate7520:CHARTERED 01:203.126.246.216]2001/11/07 16:27:41 Isakmp ScSA: Rekey Phase 2: Loc:10.200.*.*, Rem:10.84.3.50 (66.68.164.196) But what happens is that everything ends up in teh "all" destination instead of the vpn destination....