Great stuff in here. I wasjust wondering whethet substring matches aren't the expectrd behaviour here? -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20130905/2a42e50e/attachment.htm