Would I be right in thinking that Syslog-ng's ability to use multiple message sources could be useful in building chroot jails on Linux, e.g. would source src { unix-stream /dev/log; /chroot/named/dev/log; internal; }; work in place of using holelogd?

Yes. But a bit different syntax: source src { unix-stream /dev/log; unix-stream /chroot/named/dev/log; ... }; Or each could have a distinct source: source syssrc { unix-stream /dev/log; internal; }; source namedsrc { unix-stream /chroot/named/dev/log; }; and so on. -- Bazsi PGP key: http://www.balabit.hu/pgpkey.txt, or finger bazsi@balabit.hu