The expression : log { source(src); filter(f_mail); filter(f_info); destination(mailinfo); }; write for destination(mailinfo) the messages where " filter(f_mail) AND filter(f_info) " is true or " filter(f_mail) OR filter(f_info) " is true ? Because in my syslog-ng.conf I have : destination mailinfo { file("/var/log/syslog-ng/gandalf/mail.info"); }; destination mailwarn { file("/var/log/syslog-ng/gandalf/mail.warn"); }; filter f_mail { facility(mail); }; filter f_info { level(info); }; filter f_warn { level(warn); }; log { source(src); filter(f_mail); filter(f_info); destination(mailinfo); }; log { source(src); filter(f_mail); filter(f_warn); destination(mailwarn); }; and my logs "mailinfo" and "mailwarn" are same . Kleyson Rios. Brazil.