Hello, I'm trying to drop a certain set of messages. Following http://www.balabit.com/dl/html/syslog-ng-admin-guide_en.html/ch07s08.html I notice that if I do *not* include a 'destination' in the 'log' statement, then a very large number of messages that should *not* be dropped are in fact dropped. As soon as I add a 'destination' to the log statement, it filters the correct messages. That is: destination d_dev_null { file("/dev/null" perm(0666) ); }; filter demo_debugfilter { (level(debug..notice) and facility(local0); }; log { source(s_udp); filter(demo_debugfilter); flags(final); }; Appears to falsely drop a number of messages that were of local1.info. As soon as I change the 'log' directive to be: log { source(s_udp); filter(demo_debugfilter); destination(d_dev_null); flags(final); }; it correctly filters only level0.{debug,info,notice}. This happens on a host with a large number of messages per second, but not on a host that receives very little traffic. I can't make much sense of this and was hoping somebody on this list could... -Jan