Hi,

I'm running a central syslog-ng server with the following syslog-ng.conf:

options { sync (0); time_reopen (10); log_fifo_size (1000); long_hostnames (off); use_dns (yes); use_fqdn (no); create_dirs (no); keep_hostname (yes); };

source s_sys { unix-stream ("/dev/log"); internal(); }; source s_remote { udp(ip(0.0.0.0) port(514)); };

destination d_mesg { file("/var/log/messages"); }; destination d_powerpay { file("/var/log/powerpay"); };

filter f_powerpay { facility(local1); };

log { source(s_sys); destination(d_mesg); }; log { source(s_remote); filter(f_powerpay); destination(d_powerpay); }; log { source(s_remote); destination(d_mesg); };

I have serveral AIX servers that don't seem to get logged. I'm sending messages with facility set to local1. If I comment out the second log line above I get messages from the AIX servers to my messages file. When I enable the second log line as it is above I get nothing. I've tested sending messages from other platforms with facility set to local1 and they get logged in the correct file as expected.

/var/log/messages should get a copy of each message regardless of the second logline. you should check whether syslog-ng receives the lines correctly with a truss or an strace. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1