I now have these messages reported: Aug 5 03:33:56 bc-bd deliver(bd): msgid=<r3l_p2g-BpVHWKE-kMWIRzBGUCnzo9_l7hOHzYLG_4X6oEjXrJ4rJdB10yXPT2jmJJ7ppBmr-x8 at ...: saved mail to INBOX.git I hope this: ^\w{3} [ :[:digit:]]{11} [._[:alnum:]-]+ deliver\([-_.@[:alnum:]]+\): msgid=(<[^[:space:]]+[>*]|:)?( \((added by [^[:space:]]+|sfid-[_[:xdigit:]]+)\))?: (saved mail to [-_.[:alnum:]]+|forwarded to <[^[:space:]]+>)$ does the trick. Stefan -- BOFH excuse #287: Telecommunications is downshifting.