I'm still hoping someone on this list can help me out. My syslog-ng configuration seems to be mixing things up. I am TRYING to separate things, so that anything from sshd goes to /var/log/sshd/sshd.log, anything from samba goes to /var/log/samba/log.samba, and anything ELSE hitting the syslog is going to /var/log/messages. My problem is, the sshd log seems to be picking up samba messsages, and the main log (/var/log/messages) is picking up them BOTH. But I have filters in my config to say this one, not that one. If anyone is willing to help me out, the following files are live on my web server: https://www.newideatest.site/syslog-conf The current syslog-ng.conf https://www.newideatest.site/system_log Current /var/log/messages https://www.newideatest.site/syslog-ng-debug The debug output from the current instance of syslog-ng -Fdav These files are direct links to the actual files, so whatever you see there is exactly what is there at the moment you check. Please help?