ups ... there was a typo the filter is filter f_switches { netmask(10.16.254.0/24); }; - Henning "Henning Markussen" <hem@dmdata.dk> Sent by: syslog-ng-admin@lists.balabit.hu 24-02-2004 08:24 Please respond to syslog-ng To: syslog-ng@lists.balabit.hu cc: Subject: [syslog-ng]filter netmask Hi I have the following syslog Feb 24 08:01:04 10.1.76.35 28: Feb 24 08:01:03.674 CET: %SYS-5-CONFIG_I: Configured from console by xxxxxx on vty0 (10.16.254.42) filter f_switches { netmask(10.16.65.0/24); }; But the filter f_switches matches it, why is that ? The only place I can see that it could mask is in the 'vty0 (10.16.254.42)' but I thought that the netmask was suppose to match in the hostname field and not the message I looked at http://www.balabit.com/products/syslog_ng/reference/x567.html but there the netmask filter isn't described. - Henning _______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html