Hello :) When cron runs, it sends the following lines Apr 18 16:50:01 martinII PAM_unix[26181]: (cron) session opened for user smmsp by (uid=0) Apr 18 16:50:01 martinII PAM_unix[26182]: (cron) session opened for user runa by (uid=0) Apr 18 16:50:01 martinII PAM_unix[26183]: (cron) session opened for user runa by (uid=0) Apr 18 16:50:02 martinII PAM_unix[26181]: (cron) session closed for user smmsp Apr 18 16:50:25 martinII PAM_unix[26183]: (cron) session closed for user runa Apr 18 16:50:27 martinII PAM_unix[26182]: (cron) session closed for user runa I want to filter those lines and send them to other files, so I did: filter f_cron2{match("(cron) session opened");}; log { source(src); filter(f_cron2); destination(cron);}; but it sends the lines to auth.log! what am I doing wrong? __________________________________________________ Do You Yahoo!? Yahoo! Tax Center - online filing with TurboTax http://taxes.yahoo.com/