1. Once my linux box receive a log, how can I redirect this log message to someone's mail(someone@somewhere.com)?

You could use the program() destination to send messages to a custom script, which may send an email or anything you want to.

2. Can I filter out some string that I don't want in a single log message line?

I don't exactly understand what you mean here. If you want to filter out messages containing some string, you can do that of course: source src {}; destination dst {}; filter f_nm { not match("stringtofilter"); }; log { source(src); filter(f_nm); destination(dst); }; -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt