Hi... I'm running Syslog-ng 1.4.3 as a loghost and on a workstation behind a gateway... both RedHat 6.1 hmmm problems i've found... '#' seems to work not correctly... i've comment a few things in my syslog-ng.conf... and if the comment was not at the beginning of a line.. i got a parsing error.. '#' seems not to comment out log, source, ... -statements.... if i comment out the destination and filter rule for ppp from the standart debian example syslog-ng.conf .... i got a parsing error... saying something like... ppp was an unresolve identifer... and here my sugestions... what about ...say 'virtual pipes'.... or bracket rules... what i meen is... if you have a logingstatement like this log {source(src1); filter(f_1); source(src2); destination(dst1); }; (this seems to work on my maschine... throu this is not documented) and you now want to filter src2 with another filter.... when filter f_2 will filter both.... and not just the 2nd source... There would be something like a internal pipe helpy... So you define a pipe and use this to curving around the 2nd source and filter... or what would be even better... to create brackets around the 2nd source and filter... so the filter will just afect src2.... customized macros... what about just defining your own macros... say like constants... for example you can define LOGDIR="/var/log"; and then in a destination-rule it will sound like destination warn {file("$LOGDIR/warn");}; ....or just... FNW="not filter(warn);"; but i thing macros an const have to be captalized by definition... Felix... ICQ: 5227897/samon007 PS:Thanxs for writing this great programm...