Hi everyone, Our syslog-ng server is logging all our cisco css (arrowpoint) syslogs into a file called "5". For all the other network devices, it is getting correctly logged under the host IP. Has anyone experienced this behavior ? Is there a workaround? -ajay

tcpdump is your friend to check what is arriving on the wire. I wouldn't be surprised if your Ciscos violated the syslog protocol. Syslog-ng supports several log formats, so you should at least show what format the Ciscos are using. BTW what version of syslog-ng are you running? Regards, Sandor -------------------------------------------------------- NOTICE: If received in error, please destroy and notify sender. Sender does not intend to waive confidentiality or privilege. Use of this email is prohibited when received in error.