I have used the following syslog-ng config file on HP-UX 11.23 (syslog-ng 1.6.6) and have not seen any problem : options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (yes); use_fqdn (no); create_dirs (yes); keep_hostname (yes); }; # Source source s_sys { pipe("/dev/log" pad_size(2048)); internal(); }; # Destination destination d_mesg { file("/var/adm/syslog/syslog-ng/syslog.log"); }; destination d_mail { file("/var/adm/syslog/syslog-ng/mail.log"); }; destination d_cons { file("/dev/console"); }; destination d_mail { file("/var/adm/syslog/syslog-ng/mail.log"); }; destination d_cons { file("/dev/console"); }; destination d_mlrt { usertty("root"); }; destination d_mlal { usertty("*"); }; # Filter filter f_filter1 { facility(mail) and level(debug .. emerg); }; filter f_filter2 { level(info .. emerg) and not facility(mail); }; filter f_filter3 { level(alert .. emerg); }; filter f_filter4 { level(emerg); }; # Log log { source(s_sys); filter(f_filter1); destination(d_mail); }; log { source(s_sys); filter(f_filter2); destination(d_mesg); }; log { source(s_sys); filter(f_filter3); destination(d_cons); destination(d_mlrt); }; log { source(s_sys); filter(f_filter4); destination(d_mlal); }; Note : If your destination directories do not exist you need the "create_dirs (yes);" in the options. Also, make sure that syslogd is stopped. I used the following test program, and all messages show up in /var/adm/syslog-ng/mail.log and /var/adm/syslog/syslog.log resp. ( #!/usr/bin/sh echo "Testing mail" logger -p mail.debug "test mail debug" logger -p mail.info "test mail info" logger -p mail.notice "test mail notice" logger -p mail.warning "test mail warning" logger -p mail.err "test mail err" logger -p mail.crit "test mail crit" logger -p mail.alert "test mail alert" logger -p mail.emerg "test mail emerg" echo "Testing syslog" logger -p auth.debug "test syslog debug" logger -p user.info "test syslog info" logger -p auth.notice "test syslog notice" logger -p news.warning "test syslog warning" logger -p daemon.err "test syslog err" logger -p lpr.crit "test syslog crit" logger -p cron.alert "test syslog alert" logger -p kern.emerg "test syslog emerg" Jenny-Lou Sequeira