Thanks for the response. Sorry to sound ignorant, but what do you mean by truss or a strace? Is that a type of bracket? Below is the output I get to /var/log/messages: Feb 21 21:41:25 Message forwarded from ppsvrwasprd2: pskavins: testing using local1.notice John Delisle Corporate Technology Ceridian Canada Ltd 204-975-5909 Balazs Scheidler <bazsi@balabit.hu> To: syslog-ng@lists.balabit.hu Sent by: cc: syslog-ng-admin@lists. Subject: Re: [syslog-ng]AIX compatability issue? balabit.hu 2001/02/23 05:34 AM Please respond to syslog-ng Hi,

I'm running a central syslog-ng server with the following syslog-ng.conf:

options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (yes); use_fqdn (no); create_dirs (no); keep_hostname (yes); };

source s_sys { unix-stream ("/dev/log"); internal(); }; source s_remote { udp(ip(0.0.0.0) port(514)); };

destination d_mesg { file("/var/log/messages"); }; destination d_powerpay { file("/var/log/powerpay"); };

filter f_powerpay { facility(local1); };

log { source(s_sys); destination(d_mesg); }; log { source(s_remote); filter(f_powerpay); destination(d_powerpay); }; log { source(s_remote); destination(d_mesg); };

I have serveral AIX servers that don't seem to get logged. I'm sending messages with facility set to local1. If I comment out the second log line above I get messages from the AIX servers to my messages file. When I enable the second log line as it is above I get nothing. I've tested sending messages from other platforms with facility set to local1 and they get logged in the correct file as expected.

/var/log/messages should get a copy of each message regardless of the second logline. you should check whether syslog-ng receives the lines correctly with a truss or an strace. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng