Hi all. I have some network devices witch syslog function from example 1. 192.168.0.1 2. 192.168.0.10 I create syslog config and define this filter's ---------------------------------------------------------------------------- ------------------------------------- source s_network { udp ( ip (0.0.0.0) port (514) ); }; filter cisco_1 { host ("192.168.0.1"); }; filter at-rpg6_1 { host ("192.168.0.10"); }; destination cisco_1 { file ( /usr/local/syslog-ng/log/cisco.log ); }; destination d_file_6 { file ( /usr/local/syslog-ng/log/at-rpg6.log ); }; log { source ( s_network ); filter ( cisco_1 ); destination ( cisco_1); }; log { source ( s_network ); filter ( at-rpg6_1 ); destination ( d_file_6 ); }; ---------------------------------------------------------------------------- --------------------------------------- In this config I have some mistake, messages send from 192.168.0.10 stored into /usr/local/syslog-ng/log/at-rpg6.log And it also stored /usr/local/syslog-ng/log/cisco.log What's wrong ? forgive me for bad english WBR swop.