You need to add the syslog door to the source list. I use this source on the 5.6 systems source local { sun-streams("/dev/log" door("/etc/.syslog_door") ); internal(); udp(ip(0.0.0.0) port(514) ); }; and this one on 5.8 systems source local { sun-streams("/dev/log" door("/var/run/syslog_door") ); internal(); udp(); }; The cluster messages go to the local0 facility by default. The switch over messages come out as local0.err. It is a really good idea to replicate the cluster messages to a local file and to the console. If you have a public network failure and the cluster reconfigures the messages will be lost. Russell -----Original Message----- From: Franco Cucchi [mailto:franco.cucchi@db.com] Sent: Thursday, 26 October 2000 5:16 a.m. To: syslog-ng@lists.balabit.hu Cc: Manuela Burzoni Subject: [syslog-ng]/var/adm/messages Hi all, I installed the syslog-ng on two SUN machines those are in cluster. The messages generated by the machines those refer to the cluster software are stored in the /var/adm/messages file. In this file it's possible to find the 12 steps sequence of messages generated when the logical host switches from a machine to another due to a failure or a forced takeover. I would like to know if the syslog-ng, with is config file reported below, redirects ALL messages generated (I mean also the log from cluster software) to the machine I use as loghost and not permit the file /var/adm/messages to be written as normal. Any advice or correction welcome. Thanks all Franco # this file show more or less all the features of syslog-ng options { sync(0); time_reopen(10); log_fifo_size(100); }; source direct { sun-stream("/dev/log"); internal();}; source tngsrc { file ("/var/adm/sulog");}; destination loghost { tcp("10.138.xxx.xxx" port (516)); }; destination tngdest { pipe("/usr/tngem/opr/config/dbf1/pipe/oprpipe0009"); }; log { source (direct); destination (loghost); }; log { source (direct); destination (tngdest); }; -- Diese E-Mail enthält vertrauliche und/oder rechtlich geschützte Informationen. Wenn Sie nicht der richtige Adressat sind oder diese E-Mail irrtümlich erhalten haben, informieren Sie bitte sofort den Absender und vernichten Sie diese Mail. Das unerlaubte Kopieren sowie die unbefugte Weitergabe dieser Mail ist nicht gestattet. This e-mail may contain confidential and/or privileged information. If you are not the intended recipient (or have received this e-mail in error) please notify the sender immediately and destroy this e-mail. Any unauthorised copying, disclosure or distribution of the material in this e-mail is strictly forbidden. _______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng