I fixed it.... after I found the link to the archives, I managed to figure out that the ; makes a big difference. -- Kevin -----Original Message----- From: Kevin Welch Sent: Thursday, April 04, 2002 2:57 AM To: 'syslog-ng@lists.balabit.hu' Subject: Filter Question. Im trying to setup a filter as follows: filter f_terse { facility(local7); and match("%CALLRECORD-3-MICA_TERSE_CALL_REC"); }; filter f_notterse { facility(local7); and not match("%CALLRECORD-3-MICA_TERSE_CALL_REC"); }; Now my problem is that this doesnt work and kicks back an error, it seems I cannot use the match keyword and define other parameters. Is this correct or do I have the syntax messed up? My reason for needing this is that terse call records from my my dial systems take over 10000 calls a day and generate alot of syslog information, I need a way to filter these to a different logfile from other syslog events. Thanks -- Kevin