Hi, with the central logging of syslog in place, I moved on to the file /var/log/httpd/ssl_error_log to explore the syslog-ng (3.0.2-1 OSE on CentOS 5.3) capabilities with logfiles from other applications. The contents of this file are rather straightforward: [Wed Jun 24 12:14:49 2009] [warn] RSA server certificate is a CA certificate (BasicConstraints: CA == TRUE !?) [Wed Jun 24 12:14:49 2009] [error] [client 192.168.3.178] PHP Notice: Undefined offset: 2 I want to skip the date/time (assuming there is no delay before syslog-ng processes the data) and to set the PRIORITY and LEVEL attributes to "warning" and "err". The following config file (included in the main config) should do the job. source s_http_ssl_error { file ( "/var/log/httpd/ssl_error_log" flags(no-parse) follow_freq(1) ); }; # Split the message. parser p_http_ssl_error { csv-parser( columns( "HTTP.TIMESTAMP", "HTTP.SEVERITY", "HTTP.MSG" # Match the remainder of the message (greedy). ) delimiters( " " ) flags( greedy, escape-double-char, strip-whitespace ) quote-pairs( '""[]' ) ); }; filter f_http_ssl_error_warn{ match( "warn" value( "HTTP.SEVERITY" ) ); }; rewrite r_http_ssl_error_warn{ set( "warning" value( "LEVEL" ) ); set( "warning" value( "PRIORITY" ) ); }; filter f_http_ssl_error_error{ match( "error" value( "HTTP.SEVERITY" ) ); }; rewrite r_http_ssl_error_error{ set( "err" value( "LEVEL" ) ); set( "err" value( "PRIORITY" ) ); }; # Eliminate the severity as soon as PRIORITY and LEVEL are set! # Set the attribute program to "http_ssl_error". template t_http_ssl_error{ template( "http_ssl_error ${HTTP.SEVERITY} ${HTTP.MSG}\n" ); }; # Send the message to the regular syslog in order to transfer it to the syslog-ng collector. destination d_http_ssl_error{ unix-dgram( "/dev/log" template( t_http_ssl_error ) ); }; # Handle the warnings. log { source( s_http_ssl_error ); parser( p_http_ssl_error ); filter( f_http_ssl_error_warn ); rewrite( r_http_ssl_error_warn ); destination( d_http_ssl_error ); flags( final ); }; # Handle the errors. log { source( s_http_ssl_error ); parser( p_http_ssl_error ); filter( f_http_ssl_error_error ); rewrite( r_http_ssl_error_error ); destination( d_http_ssl_error ); flags( final ); }; # Handle the other messages. log { source( s_http_ssl_error ); parser( p_http_ssl_error ); destination( d_http_ssl_error ); }; Inserting [warn], [error] and [other] lines in the logfile, results in the proper number of syslog-ng messages with the desired MSG-contents. However, the priority and level attributes are unchanged ("notice"). What is wrong? kind regards, Siem Korteweg