Hello, Can someone help me out with this one. I am trying to log local2.debug pop logs to a central log server to a file called poplog. It is not logging to poplog but instead messages in the same dir. Here is what I have in my syslog-ng.conf. options { keep_hostname(no); long_hostnames(off); sync(1); log_fifo_size(1024); create_dirs(yes); use_dns(no); }; source src_local { unix-stream("/dev/log"); internal(); }; source src_network { udp(); }; <snip> destination messages.network { file("/opt1/log/hosts/$HOST/$YEAR/$MONTH/$DAY/messages" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes) ); }; destination poplog.network { file("/opt1/log/hosts/$HOST/$YEAR/$MONTH/$DAY/poplog" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes) ); }; <snip> filter f_messages { not facility(authpriv, mail, cron) and level(info, notice, warn, crit, err, alert, emerg); }; filter f_pop { facility(local2) and level(debug); }; <snip> log { source(src_network); source(src_local); filter(f_messages); destination(messages.network); }; log { source(src_network); filter(f_pop); destination(poplog.network); }; I thought that it might be reading the file from the top down, so I moved the pop filter before the messages filter, did not help. Also added local2 to the facility in messages filter and it stop logging to messages, but also stoped logging all together. Thanks, Keith