I am confused by the documentation with respect to the possibility of directing output based on the *name* of an application. For example, consider 2 legacy applications - appName1 and appName2 - that historically wrote to syslogd via the LOG_USER facility. Using syslog-ng, can I redirect each app's log to different files via the syslog-ng.conf file? if this is do-able, is the following the correct approach? source src { unix-stream("/dev/log"); internal(); }; destination app1 { file("/var/log/app1.log") }; destination app2 { file("/var/log/app2.log") }; filter f_app1 { program("appName1") }; filter f_app2 { program("appName2") }; log { source(src); filter(f_app1); destination(app1); }; log { source(src); filter(f_app2); destination(app2); }; Also, it is not clear to me how i make the program-name (eg, "appName1") known to syslog-ng in the first place. Any help/advice welcome. (Oh, Running RH 7.x Linux, to the extent this may matter) Tia, - rich -- racoco@sockeye.com Sockeye Networks 52 Second Ave Suite 100 Waltham, MA 02451 781.693.7051