ok I have correct this line in my syslog-ng.conf destination hosts { file("/var/log/hosts/$HOST/$FACILITY/$MONTH/$DAY/$FACILITY$YEAR$MONTH$DAY" template("$MSG\n") owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)); }; and now log looks like this squid: 1033739673.117 10818 192.168.1.29 TCP_REFRESH_MISS/200 19595 GET http://lists.balabit.hu/pipermail/syslog-ng/ - DIRECT/62.80.73.147 text/html squid: 1033739687.778 3124 192.168.1.29 TCP_MISS/200 180 GET http://216.239.33.102/search? - DIRECT/216.239.33.102 text/html I need exclude word "squid" from logs, it need for SQRMGLOG. It doesn't work correctly with this log How ????????? Alexander Chernyh Network Administrator The Publishing House "Galitsky Kontrakty" http://www.gc.lviv.ua E-mail: alexch@gc.lviv.ua CHA-UANIC: http://uanic.com.ua ICQ 108387628