Hello group, I have just installed syslog-ng 1.4.17 and playing with it on RH 7.3 Initially I was getting crond messages in my logs (was attempting to send them to a separate cron log file, but they were ending up in both /var/log/cron as well as the standard /var/log/messages files. I tried to change the filter (I hadn't matched the case, etc...) thinking that may help. The messages stopped going to both places. I have tried various things like changing it back, re-organizing the filter/log statements (grasping at straws), and added a log entry for filter(DEFAULT), but I still can't seem to get them to come back. Here is my conf file: options { sync(0); chain_hostnames(no); dir_perm(0755); perm(0644); time_reopen(10); log_fifo_size(1000); long_hostnames(off); use__dns(yes); use_fqdn(yes); create_dirs(yes); keep_hostname(yes); }; source s_sys { unix-stream("/dev/log"); internal(); udp(); }; destination d_cons { file("/dev/console"); }; destination d_mesg { file("/var/log/messages"); }; destination d_auth { file("/var/log/secure"); }; destination d_mail { file("/var/log/maillog"); }; destination d_spol { file("/var/log/spooler"); }; destination d_boot { file("/var/log/boot.log"); }; destination d_hosts { file("/var/syslog/hosts/$YEAR/$MONTH/$HOST" owner(root) group(root) perm(0644) dir_perm(0700) create_dirs(yes)); }; destination d_mlal { usertty("*"); }; destination d_cron { file("/var/log/cron"); }; filter f_auth { facility(authpriv); }; filter f_cron { facility(CROND) or facility(cron); }; filter f_mail { facility(mail); }; filter f_emergency { level(emerg); }; filter f_spooler { facility(uucp) or (facility(news) and level(crit)); }; filter f_boot { facility(local7); }; filter f_hosts { facility(local3) or facility(local4); }; # filter f_mesg { level(info) or facility(mail) or facility(authpriv) or facility(user) and not facility(cron); }; log { source(s_sys); filter(f_auth); destination(d_auth); }; log { source(s_sys); filter(f_cron); destination(d_cron); }; log { source(s_sys); filter(f_mail); destination(d_mail); }; log { source(s_sys); filter(f_emergency); destination(d_mlal); }; log { source(s_sys); filter(f_spooler); destination(d_spol); }; log { source(s_sys); filter(f_boot); destination(d_boot); }; log { source(s_sys); filter(f_hosts); destination(d_hosts); }; # log { source(s_sys); filter(f_mesg); destination(d_mesg); }; log { source(s_sys); filter(DEFAULT); destination(d_mesg); }; Here is a sample of the /var/log/cron file that has a couple of the messages that aren't showing up: Mar 6 15:10:00 chumly CROND[6213]: (root) CMD (/home/mrtg/run-rrd-cfgs) Mar 6 15:15:00 chumly CROND[6232]: (root) CMD (/home/mrtg/run-rrd-cfgs) I have implemented the init.d file that is included in the contrib directory, and between config file changes, used service syslog-ng restart to kick it into re-reading the new conf file. Any ideas what I am doing wrong, or where to start looking? I am relatively new to the whole linux world, but trying very hard to get a handle on things. :-) Any help is appreciated. Tim _________________________________________________________________ Protect your PC - get McAfee.com VirusScan Online http://clinic.mcafee.com/clinic/ibuy/campaign.asp?cid=3963