Config file looks like this: jans01@mimas:/etc/local/syslog-ng-1.4.13/etc$ cat syslog-ng.conf # SYSLOG-NG Configuration File # # SSDC GENERIC 2001.06.22.00 options { long_hostnames (off) ; use_dns (no) ; use_fqdn (yes) ; keep_hostname (yes) ; chain_hostnames (no) ; } ; source syslog { sun-streams ("/dev/log" door ("/etc/.syslog_door")) ; internal () ; } ; destination d_loghost { tcp (host.domain.net port(514)) ; } ; destination d_messages { file ("/var/adm/messages") ; } ; filter f_messages { level (error) or facility (auth, kern) and level (notice) or facility (mail) and level (crit) ; } ; log { source (syslog) ; filter (f_messages) ; destination (d_messages) ; } ; log { source (syslog) ; destination (d_loghost) ; } ; nslookup on the syslog host works: ---- jans01@mimas:/etc/local/syslog-ng-1.4.13/etc$ nslookup host.domain.net Server: xxxxxx.xxxxx.xxxxx Address: xxx.xxx.xxx.xxx Name: xxxxxxxx.xxxxxxx.xxxxxx Address: xxx.xxx.xxx.xxx Aliases: host.domain.net ---- Hope this helps. Btw - I use this same configuration file on all the other hosts that do work as well. J.