MiikaT What you are trying to do isn't too bad with syslog-ng. If you use the filter functions on this page http://www.balabit.com/products/syslog_ng/reference/x567.html#FILTERFUNC you can make something like it sounds you need. Here is a snippit of what I do this setup a listener, create a destination file based upon the host and date, the filter logs only on the host which the log came from. source rsrc { udp(ip(0.0.0.0) port(514)); }; filter f_cne_rtr { host("grrcis*") or host("grrnor*"); }; destination d_cne_rtr { file("/var/log/cne/routers/$HOST/$YEAR/$MONTH/$FULLDATE.log" owner(root) group(logs) perm(0640) dir_perm(0770) create_dirs(yes) ); }; log { source(rsrc); filter(f_cne_rtr); destination(d_cne_rtr);}; Hope that helps. Mark