I am getting duplicate log entries for mail.notice and mail.warning. I am also not quite clear on the garbage collecting parameters. Thanks for your help. :) Ed syslog-ng 1.6.9 The initital syslog-ng.conf file was created by the FreeBSD Port. I have modified the entries for mail to isolate mail logging. I am logging for 13 FreeBSD servers and 1 Pix Firewall The daily throughput is 7.3 million log entries per day. This will increase by 5 in the next few months as we migrate from the old mail servers to the new mail servers Below is the current configuration file. Here are the mail entries. destination maillog { file("/var/log/$HOST/maillog"); }; filter f_mail { facility(mail); }; filter f_m_info { level(info,notice,warning,debug); }; log { source(src); filter(f_mail); filter(f_m_info); destination(maillog);}; Hardware configuration ---------------------- DELL Poweredge 2850 Dual 3.0GHZ Xeon Processors 2G Memory OS on Mirrored 73G 10K Ultra320 SCSI SYSLOG on Mirrored 300G 10K Ultra320 SCSI Running FreeBSD 6 using a SMP kernel syslog-ng.conf -------------- # # This sample configuration file is essentially equilivent to the stock # FreeBSD /etc/syslog.conf file. # # # options # options { time_reopen (1); log_fifo_size (999999); use_fqdn(yes); keep_hostname (yes); create_dirs(yes); sync(0); use_dns (yes); dns_cache(yes); dns_cache_size(1000); dns_cache_expire(604800); gc_idle_threshold(600); gc_busy_threshold(500000); }; # # sources # source src { unix-dgram("/var/run/log"); unix-dgram("/var/run/logpriv" perm(0600)); tcp(); udp(); internal(); file("/dev/klog"); }; # # destinations # destination clamav { file("/var/log/$HOST/clamav"); }; destination messages { file("/var/log/$HOST/messages"); }; destination security { file("/var/log/$HOST/security"); }; destination authlog { file("/var/log/$HOST/auth.log"); }; destination maillog { file("/var/log/$HOST/maillog"); }; destination firewall { file("/var/log/firewall/firewall"); }; destination lpd-errs { file("/var/log/$HOST/lpd-errs"); }; destination xferlog { file("/var/log/$HOST/xferlog"); }; destination cron { file("/var/log/$HOST/cron"); }; destination debuglog { file("/var/log/$HOST/debug.log"); }; destination consolelog { file("/var/log/console.log"); }; destination all { file("/var/log/all.log"); }; destination newscrit { file("/var/log/news.crit"); }; destination newserr { file("/var/log/news.err"); }; destination newsnotice { file("/var/log/news.notice"); }; destination slip { file("/var/log/slip.log"); }; destination ppp { file("/var/log/ppp.log"); }; destination console { file("/dev/console"); }; destination allusers { usertty("*"); }; #destination loghost { udp("loghost" port(514)); }; # # log facility filters # filter f_auth { facility(auth); }; filter f_authpriv { facility(authpriv); }; filter f_not_authpriv { not facility(authpriv); }; filter f_console { facility(console); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_ftp { facility(ftp); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_not_mail { not facility(mail); }; filter f_news { facility(news); }; filter f_security { facility(security); }; filter f_user { facility(user); }; filter f_uucp { facility(uucp); }; filter f_local0 { facility(local0); }; filter f_local1 { facility(local1); }; filter f_local2 { facility(local2); }; filter f_local3 { facility(local3); }; filter f_local4 { facility(local4); }; filter f_local5 { facility(local5); }; filter f_local6 { facility(local6); }; filter f_local7 { facility(local7); }; # # log level filters # filter f_emerg { level(emerg); }; filter f_alert { level(alert..emerg); }; filter f_crit { level(crit..emerg); }; filter f_err { level(err..emerg); }; filter f_warning { level(warning..emerg); }; filter f_notice { level(notice..emerg); }; filter f_info { level(info,debug); }; filter f_debug { level(debug..emerg); }; filter f_is_debug { level(debug); }; filter f_m_notice { level(notice); }; filter f_m_info { level(info,notice,warning,debug); }; # # program filters # filter f_ppp { program("ppp"); }; filter f_slip { program("startslip"); }; # # *.err;kern.warning;auth.notice;mail.crit /dev/console # log { source(src); filter(f_err); destination(console); }; log { source(src); filter(f_kern); filter(f_warning); destination(console); }; log { source(src); filter(f_auth); filter(f_notice); destination(console); }; log { source(src); filter(f_mail); filter(f_crit); destination(console); }; # # *.notice;authpriv.none;kern.debug;lpr.info;mail.crit;news.err /var/log/messages # log { source(src); filter(f_notice); filter(f_not_mail); destination(messages); }; log { source(src); filter(f_kern); filter(f_debug); destination(messages); }; log { source(src); filter(f_lpr); filter(f_info); destination(messages); }; log { source(src); filter(f_news); filter(f_err); destination(messages); }; # # clamav # log { source(src); filter(f_local6); destination(clamav); }; # # security.* /var/log/security # log { source(src); filter(f_security); destination(security); }; # # auth.info;authpriv.info /var/log/auth.log log { source(src); filter(f_auth); filter(f_info); destination(authlog); }; log { source(src); filter(f_authpriv); filter(f_info); destination(authlog); }; # # mail.info /var/log/maillog # log { source(src); filter(f_mail); filter(f_m_info); destination(maillog); }; # # lpr.info /var/log/lpd-errs # log { source(src); filter(f_lpr); filter(f_info); destination(lpd-errs); }; # # ftp.info /var/log/xferlog # log { source(src); filter(f_ftp); filter(f_info); destination(xferlog); }; # # cron.* /var/log/cron # log { source(src); filter(f_cron); destination(cron); }; # # *.=debug /var/log/debug.log # log { source(src); filter(f_is_debug); destination(debuglog); }; # # *.emerg * # #log { source(src); filter(f_emerg); destination(allusers); }; # # uncomment this to log all writes to /dev/console to /var/log/console.log # console.info /var/log/console.log # #log { source(src); filter(f_console); filter(f_info); destination(consolelog); }; # # uncomment this to enable logging of all log messages to /var/log/all.log # touch /var/log/all.log and chmod it to mode 600 before it will work # *.* /var/log/all.log # #log { source(src); destination(all); }; # # uncomment this to enable logging to a remote loghost named loghost # *.* @loghost # #log { source(src); destination(loghost); }; # # uncomment these if you're running inn # news.crit /var/log/news/news.crit # news.err /var/log/news/news.err # news.notice /var/log/news/news.notice # #log { source(src); filter(f_news); filter(f_crit); destination(newscrit); }; #log { source(src); filter(f_news); filter(f_err); destination(newserr); }; #log { source(src); filter(f_news); filter(f_notice); destination(newsnotice); }; # # !startslip # *.* /var/log/slip.log # log { source(src); filter(f_slip); destination(slip); }; # # !ppp # *.* /var/log/ppp.log # log { source(src); filter(f_ppp); destination(ppp); };