When syslog-ng sends a terminal message for the 'usertty' destination, it looks in utmp to find what terminal the user is using. It gets the "line name" from utmp (e.g. "tty1") and appends it to "/dev/" to get the device special file name for the user's terminal, e.g. "/dev/tty1". utmp can also contain the device special file name itself as the line name. For example, on my system, logins use devices in /var/dev and utmp can say "/var/dev/tty1". The following modification makes Syslog work with such a utmp entry: --- syslog-ng/src/afuser.c 2007-01-21 23:11:26.000000000 +0000 +++ syslog-ng-2.0.1/src/afuser.c 2007-01-19 23:11:37.000000000 +0000 @@ -124,5 +74,2 @@ - if (ut->ut_line[0] == '/') - strcpy(line, ""); - else strcpy(line, "/dev/"); -- Bryan Henderson San Jose, California