Hi Mukarram, If you posted an example of some of these 5000 lines to this list I think there's a good chance that some of the clever people here would be able to replace them with a much smaller equivalent (i.e. one that dynamically caters for the different source host names, etc.). Then it would not only be much shorter and more efficient, but you probably wouldn't ever have to change it again. Regards, Scott Also, I hope syslog-ng 3.3 will fix the issue with my syslog-ng.conf having greater than 5000 lines. Syslog-ng 3.0.8 chokes on this (error: memory exhausted in /opt/syslog-ng/etc/syslog-ng.conf at line 5347). I had to revert back to syslog-ng-2.1.4 which works fine. ...or do I have to still do this which you suggested...