I used a much older version of syslog-ng previously, but the newer version is a little different, so I just want to confirm a couple of things. 1. If I install the RPM under redhat 7.2 what do I need to do to basically insure that the old syslog isn't going to kick in etc. 2. I want to split any pop activity from maillog into poplog, so I configured what I thought would work, and it does most of the time, but there are times when I pop the server, and there is no long entry. Here is my entire config. Any help appreciated.... THANKS -------- Config File ---------- # This file should be compatible with the out-of-the-box # /etc/syslog.conf on Red Hat Linux # global options # options { use_dns(yes); use_fqdn(no); use_time_recvd(no); chain_hostnames(no); mark(0); sync(0); }; source s_local { internal(); unix-stream("/dev/log" keep-alive(yes) max-connections(10)); file("/proc/kmsg"); }; # facility filters # # Jack filter f_authpriv { facility(authpriv); }; filter f_authpriv { facility(authpriv) and not program("popper"); }; filter f_boot { facility(local7); }; filter f_cron { facility(cron); }; filter f_kern { facility(kern); }; # Jack filter f_mail { facility(mail); }; filter f_mail { facility(mail) and not program("popper"); }; filter f_messages { priority(info..emerg) and not facility(mail, news, authpriv, cron, local1, local2, local3, local4, local5, local6); }; # Jack filter f_news { facility(news); }; # priority filters # filter f_crit { priority(crit..emerg); }; filter f_crit_only { priority(crit); }; filter f_emerg { priority(emerg); }; filter f_err { priority(err..emerg); }; filter f_err_only { priority(err); }; filter f_info { priority(info..emerg); }; filter f_notice { priority(notice..emerg); }; filter f_warn { priority(warning..emerg); }; # Jack filter f_pop { program(popper); }; destination d_all { usertty("*"); }; destination d_boot { file("/var/log/bootlog"); }; destination d_console { file("/dev/console"); }; destination d_cron { file("/var/log/cron"); }; destination d_mail { file("/var/log/maillog"); }; destination d_messages { file("/var/log/messages"); }; # Jack destination d_news_crit { file("/var/log/news/news.crit"); }; destination d_news_err { file("/var/log/news/news.err"); }; destination d_news_notice { file("/var/log/news/news.notice"); }; destination d_secure { file("/var/log/secure"); }; destination d_spooler { file("/var/log/spooler"); }; # Jack destination d_pop { file("/var/log/poplog"); }; # Everybody gets emergency messages log { source(s_local); filter(f_emerg); destination(d_all); }; # Log anything (except mail) of level info or higher. # Don't log private authentication messages! log { source(s_local); filter(f_messages); destination(d_messages); }; # The authpriv file has restricted access. log { source(s_local); filter(f_authpriv); destination(d_secure); }; # Jack Log all the pop mail messages. log { source(s_local); filter(f_pop); destination(d_pop); }; # Log all the mail messages in one place. log { source(s_local); filter(f_mail); destination(d_mail); }; # Log cron stuff log { source(s_local); filter(f_cron); destination(d_cron); }; # Save boot messages also to boot.log log { source(s_local); filter(f_boot); destination(d_boot); }; # # INN # log { source(s_local); filter(f_news); filter(f_crit_only); destination(d_news_crit); }; log { source(s_local); filter(f_news); filter(f_err_only); destination(d_news_err); }; log { source(s_local); filter(f_news); filter(f_notice); destination(d_news_notice); }; -------- Config File ---------- Thanks Jack