Thanks, that works... Cheers, Bret "Baltasar Cevc" <baltasar@cevc-topp.de> 09/11/2001 06:01 Sent by: syslog-ng-admin@lists.balabit.hu Please respond to syslog-ng To: <syslog-ng@lists.balabit.hu> cc: (bcc: WATSON Bret/Mgr/CSM/ST Group) Subject: RE: [syslog-ng]weird... please help Hi, Bret!

But what happens is that everything ends up in teh "all" destination instead of the vpn destination.... It should end to be shown in both...

Try to add ".*" to your host check regexp. Perhaps it doesn't match because there is something more than the single host IP. And for the all destination: you could use a third filter like this to prevent VPN messages getting there like this: filter fallb { not (filter (f_vpnhosts) or filter (f_vpnhosts2)); }; bye.baltasar ::: B A L T A S A R C E V C mailto: baltasar@cevc-topp.de Tel.: +49 89 99020515 _______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng