Angel L. Mateo wrote: ... > reference = "%{%{Packet-Type}:-format}" Which is *always* the request packet. Use %{reply:Packet-Type} for the reply. You'll have to find a way to switch the reference based on request or reply. Maybe configure two versions of the "linelog" module. Alan DeKok.