Im trying to setup a filter as follows: filter f_terse { facility(local7); and match("%CALLRECORD-3-MICA_TERSE_CALL_REC"); }; filter f_notterse { facility(local7); and not match("%CALLRECORD-3-MICA_TERSE_CALL_REC"); }; Now my problem is that this doesnt work and kicks back an error, it seems I cannot use the match keyword and define other parameters. Is this correct or do I have the syntax messed up? My reason for needing this is that terse call records from my my dial systems take over 10000 calls a day and generate alot of syslog information, I need a way to filter these to a different logfile from other syslog events. Thanks -- Kevin