Hi there

Has anyone any idea about this? It looks to me that regex don't work on
the "host()" options at all. I have mine set to a regex, and it's
capturing all sorts of traffic from other syslog clients that don't
match :-(

Remove the backslashes before the hyphens - you'd only need to do that inside a character class, e.g. [a-z\-] to match any of a through z and hyphen. Outside a character class it means itself (or if it's the first character in a character class and not escaped, like this [-a-z]).