Ok, success is on the horizon. I can start syslog-ng like this: syslog-ng -d -v -f /etc/syslog-ng/syslog-ng.conf -u log -g log where "log" is an unprivileged user (with /bin/false as a shell when it's all working, to prevent logins). The config file specifies that syslog-ng writes to: /var/log/syslog-ng/local/ But the debugging output is giving "permission denied" errors. The permissions on the directories are setup like this: # ls /var drwxr-x--- 9 root root 4096 May 8 05:11 log/ # ls /var/log drwx------ 3 log log 4096 May 8 05:13 syslog-ng/ # ls /var/log/syslog-ng drwx------ 2 log log 4096 May 8 05:13 local/ So surely the user "log" and therefore syslog-ng has permission to read and write in this directory? It doesn't appear to be the case as I can $ su log and get permission denied errors whilst trying to read, write, or even cd into the directory. The permissions on /var/log need to be set as they are, however I'm guessing that this is the root of the problem (no pun intended). Can anyone suggest a fix? mark www.darklogik.org