Does a "and" and a "or" work together? i.e.: filter f_myfilter { level(crit) and match("NOT OK") or match("terminated"); }; Would I get messages that are crit and contain "NOT OK", as well as crit and contain "terminated" Also, what is the best source statement for AIX 4.3.3? I have unix_dgram("/dev/log") and internal() Thanks, Andrew