I suppose this is a risk for any regex which isn't anchored at the start and end of line. I think I can change the regex such that can be anchored for syslog, file and lighttpd based logging, and create a seperate _apache-suhosin_ filter. (not sure about nagios). What do you think?