Hi, I've been troubleshooting a weird behaviour of syslog-ng (tried 1.6.4, 1.6.8 and 1.6.11) when the message is larger than the log_msg_size() (before i had actually noticed that fact). Basically, the problem can be reduced to: ---------- config: options { log_msg_size(50); }; source src { unix-stream("/dev/log"); internal(); }; destination d1 { file("/tmp/d1"); }; destination d2 { file("/tmp/d2"); }; filter f1 { facility(user) and level(warn..emerg); }; filter f2 { facility(user) and level(info..emerg); }; log { source(src); filter(f1); destination(d1); }; log { source(src); filter(f2); destination(d2); }; ----- # log a message > log_msg_size to syslog echo '1234567890123456789012345678901234567890123456789012345678901234567890' | logger -p user.err ------ /tmp/d1 logs: Jun 8 16:46:16 src@seb1 logger: 1234567890123456789012 ----- while /tmp/d2 logs: Jun 8 16:46:16 src@seb1 logger: 1234567890123456789012 Jun 8 16:46:16 src@seb1 345678901234567890123456789012345678901234567890 change f1's "warn" to info or lower and it starts showing the full message as well. change f2's "info" to warn or higher and it stops showing the full message as well. The original problem involves messages with newline, in which case the f1 filter only seems shows the first line, but that is probably irrelevant. I assume that despite the message being larger than the max allowed size, this shouldn't happen, or did i miss anything? thanks. -seb.