Hi, I'm using syslog-ng 1.5.23 on RedHat 8.0. I'm running swatch 3.0.4 from syslog-ng with a destination configuration like this: - - - syslog-ng.conf destination d_swatch { program("/usr/bin/swatch --config-file=/etc/swatchrc.alerts --read-pipe=\"cat /dev/fd/0\" "); }; - - - However, I don't like running swatch as root. Central loghost Mini-HOWTO <http://www.campin.net/newlogcheck.html> suggests that I could run swatch as a different user with a configuration like this: - - - syslog-ng.conf destination swatch { program("su syslog -c '/usr/bin/swatch --config-file=/etc/swatchrc --read-pipe="cat /dev/fd/0"' "); }; - - - That kind of configuration does not work for me, though. I noticed that I had to put backslashes in front of "-signs around "cat /dev/fd/0". Ideas, anyone? Best Regards, Mika -- # Mika S. Marjamäki <ext-Mika.S.Marjamaki@nokia.com> +358-40-536-9514 # Unix System Specialist, NRC Unix Team