My intent with the following filter, etc. is to exclude messages coming in from facility local7 from being logged to /var/adm/messages. It does not seem to work as those messages are making it there. Can anyone spot what might be wrong with the filter/destination/log stanza(s)? filter f_var_adm { level(emerg,alert,crit,err) or ( facility(kern) and level(debug) ) or ( facility(daemon) and level(notice) ) or ( facility(local2) and level(notice) ) or ( facility(auth) and level(notice,info) ) or ( facility(mail) and level(crit) ) and not ( facility(local7) ); }; destination d_var_adm { file("/var/adm/messages"); }; # Log all messages conforming to the f_var_adm filter to /var/adm/messages log { source(stdlog); filter(f_var_adm); destination(d_var_adm); };