I figured this out, creating an extra filter for these hosts, using boolean expressions and variables. -----Original Message----- From: Chris Vaughan Sent: Friday, 15 October 2004 3:15 PM To: 'syslog-ng@lists.balabit.hu' Subject: Filtering host IP addresses Greetings, I have recently set up syslog-ng on a host to record logs from the cisco switches deployed around the office I work in. I have set the switches to be filtered by IP address, which has created a problem. One pod of switches in a low numbered vlan has management addresses, 10.x.xxx.11 to 14. I have found that the log files for these switches are being tainted by logs from switches with addresses ending with such octets as 121, in the log for switch 10.x.xxx.12 or 143 in the log for switch 10.x.xxx.14. How do I stop events from the switches with the three digit end octets entering data into the logs for these four switches, .11 to .14? *************************************************************** This message is intended for the addressee named and may contain confidential information. If you are not the intended recipient, please delete it and notify the sender. Views expressed in this message are those of the individual sender, and are not necessarily the views of the Department of Lands. This email message has been swept by MIMEsweeper for the presence of computer viruses. ***************************************************************