Hi, Yes, the em1 interface is for our front-end connectivity and the em2 interface is for the F5 LB where traffic is sent through. By dual stack, I assume you mean IPV4/IPV6 ... in that case, no, only IPV4. It looks like syslog-ng is listening on all interfaces: Here is the output of netstat -ulp: https://gist.github.com/MrTink76/ade770cfe6d497aa50fe820a9c438f54 The part that's throwing me off is "distinct" ... shouldn't that be 9999? You see it is listening on all interfaces and the netstat -anp | grep 9999 here as well: https://gist.github.com/MrTink76/7741d90831fe4f331abe4630f3a8b29e Thanks much, Walter Tienken walter.tienken@asu.edu On 5/12/19, 8:56 AM, "Fabien Wernli" <wernli@in2p3.fr> wrote: Does your box have multiple interfaces? Does it run a dual-stack? If yes, does the program (nc or syslogng) listen on the correct interface? (netstat -ulp)