Hi again, sorry for next question.
Use a source line like this in your conf file to read kernel messages, too.
source src { pipe("/proc/kmsg"); unix-stream("/dev/log"); internal(); };
Note: do not run klogd and syslog-ng fetching local kernel messages at the same time. It may cause syslog-ng to block which makes all logging local daemons unusable. *
I've done this, but now kernel messages will appear on console now also (thanks to serial console support...) at same time like in defined file. Why? Log message was generated by iptables log with level 6 (=KERN_INFO). Current related config: source s_local { internal(); pipe("/proc/kmsg"); unix-stream("/dev/log" keep-alive(yes) max-connections(100)); unix-stream("/var/spool/postfix/dev/log" keep-alive(yes) max-connections(100)); }; filter f_kern { facility(kern); }; destination d_kern { file("/var/log/kernel-$YEAR$MONTH"); }; log { source(s_local); filter(f_kern); destination(d_kern); }; destination console isn't in use. Do I miss some configuration option? Or is this a feature? Or a bug? Thank you very much for any help, Peter -- Dr. Peter Bieringer http://www.bieringer.de/pb/ GPG/PGP Key 0x958F422D mailto: pb at bieringer dot de Deep Space 6 Co-Founder and Core Member http://www.deepspace6.net/