Hi, There was a feature request to syslog-ng, so that you could add default log statement, where all non filtered traffic goes. My question is that how this should look like in the configuration file? Alternatives: 1) log(DEFAULT) { source(src); destination(dst); }; 2) log { source(src); filter(DEFAULT); destination(dst); }; 3) log { source(src); default; destination(dst); }; 1) would add yet another complication to the grammar, 2) looks ok, 3) is not consistent with the function() like option invocation. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt