You could not reproduce it ? maybe it is specific to my platform then.. PC Debian Woody (up to date), syslog-ng deb package version 1.4.10-1.. Here is more details on my setup and results, and I attach my complete syslog-ng.conf (only the begining of my syslog-ng.conf differs from debian's default config), and a full piece of 'try.log'. ------------------- filter f_tunnel { program("tunnel"); }; filter f_dhcp { program("dhcp"); }; filter f_squid { program("squid"); }; filter f_ssh { facility(local3); }; filter f_separe { program("(tunnel)|(dhcp)|(squid)"); }; filter f_try { filter(f_separe) or filter(f_ssh); }; log { source(src); filter(f_ssh); destination(sshlog); }; log { source(src); filter(f_separe); destination(separelog); }; log { source(src); filter(f_try); destination(trylog); }; ------------------- ----------- ssh.log is ok (full of sshd messages...) ----- separe.log : allright (dhcp, squid and stunnel messages only.) Jan 19 16:13:41 zamok dhcpd-2.2.x: DHCPACK on 138.231.138.32 to 52:54:05:f5:26:39 via eth0Jan 19 16:14:17 zamok stunnel[6495]: Connection closed: 191 bytes sent to SSL, 39 bytes sent to socket Jan 19 16:14:21 zamok stunnel[6500]: tunnel-pop connected from 212.232.35.241:3636 Jan 19 16:14:26 zamok stunnel[6500]: Connection closed: 938 bytes sent to SSL, 69 bytes sent to socket Jan 19 16:14:32 zamok stunnel[6514]: tunnel-pop connected from 138.231.137.11:1663 ----- try.log : how come ? (chosen bits : ) Jan 19 16:13:33 zamok syslog-ng[6453]: syslog-ng version 1.4.10 starting Jan 19 16:13:33 zamok imapd[6455]: connect from kino.crans.org Jan 19 16:13:35 zamok imapd[6458]: Logout user=szakacs host=localhost.crans.org [127.0.0.1] Jan 19 16:13:37 zamok sshd2[386]: connection from "138.231.137.199" Jan 19 16:13:37 zamok sshd[6460]: log: Generating 768 bit RSA key. Jan 19 16:14:17 zamok cucipop[6496]: arlais 127.0.0.1 0, 0 (0), 0 (0) Jan 19 16:14:17 zamok stunnel[6495]: Connection closed: 191 bytes sent to SSL, 39 bytes sent to socket Can you see where the problem comes from ? that would be very helpful for me to be able to use 'or' correctly.. -- Sam