Hello, I have seen reference to this in some syslog-ng document but I can not find it now. What I want to do is log ftpd or dhcpd related messages to go to ftpd.log and dhcpd.log respectively. But I also have "default" rule that catches all messages not logged, currently what is happening is all the ftp and dhcpd messages are getting logged to ftpd.log and dhcpd.log , but they are also getting logged to here is the relevant section of the syslog-ng.conf file source scm_messages { unix-dgram("/dev/log"); internal(); }; filter f_ftpd { match("ftpd"); }; filter f_dhcpd { match("dhcpd"); }; destination ftpdlog { file("/var/log/ftpd.log"); }; destination dhcpdlog { file("/var/log/dhcpd.log"); }; destination scmlog { file("/var/log/scm.log"); }; log { source(scm_messages); filter(f_ftpd); destination(ftpdlog); }; log { source(scm_messages); filter(f_dhcpd); destination(dhcpdlog); }; <<- I want ftp logging to stop here log { source(scm_messages); destination(scmlog); }; <<---- This is my catchall entry Also does syslog-ng have any options to set max-size of the log file? or do I have to run logroate? Thanks. /Subodh Nijsure Software Manager - Network Media Routers SkyStream Networks