In 0.8.6-3wheezy2 it looks like the regex for _apache_error_client in the apache-common.conf isn't working any more. We had the same problem in another filter-file by including the apache-common.conf. The following regex fixed the problem: _apache_error_client = \[\] \[(:?error|\S+:\S+)\] \[client <HOST>(:\d{1,5})?\] Cheers, Guido