I'm seeing some results with filtering that I don't expect / understand. I have the following statements in syslog-ng.conf (I am just giving the relevant configuration lines): source src { unix-stream("/dev/log"); internal(); file("/proc/kmsg"); }; filter kern { facility(kern); }; filter kern_critical { filter(kern) and priority(emerg .. err); }; filter critical { filter(kern_critical) or match("crit*") or priority(emerg .. crit); }; template verbose_msg_fmt { template("$FULLDATE $FACILITY.$PRIORITY $MSG\n"); template_escape(no); }; destination root_tty { usertty("root"); }; destination critical_logfile { file("/var/log/critical.log" template(verbose_msg_fmt)); }; log { source(src); filter(critical); destination(root_tty); destination(critical_logfile); }; There are no other configuration lines which reference the critical_logfile destination , and no destination has a "final" flag. Now, when I check /var/log/critical.log, I get messages from the facility.priority combination of daemon.warning that do not contain any string starting with "crit". I also get messages from daemon.err, which also shouldn't match the filter. For example: 2007 Jul 12 10:51:07 daemon.warning <message, not containing the string crit anywhere> 2007 Jul 11 20:33:57 daemon.err <message, not containing the string crit anywhere> IIRC, I was using these same lines in a syslog-ng 1.6.x installation without these kinds of results. Also, a question: does it matter if the priority range is given in ascending or descending order (syslog's numerical code-wise)? Thanks for any insight. -- aero1967@fastmail.fm -- http://www.fastmail.fm - IMAP accessible web-mail