I have the following filter rules filter f_sonicwall { host("sonicwall") and (not match("*http*")); }; filter f_sonicwall-www { host("sonicwall") and match("*http*"); the sonicwall-www one works but the sonicwall just catches everything ignoring the not match statement i tried the following: filter f_sonicwall { host("sonicwall") and (not match("*http*")); }; filter f_sonicwall { host("sonicwall") and (not (match("*http*"))); }; filter f_sonicwall { host("sonicwall") and not match("*http*"); }; filter f_sonicwall { (host("sonicwall") and (not match("*http*"))); }; #filter f_kern { facility(kern) and not level(debug); }; Any ideas ?? ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ I am not the poet of goodness only....I do not decline to be the poet of wickedness also. -Walt Whitman ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~