Thank you very much! Adding that flag/setting worked and I was able to see a control socket file appear in my local syslog-ng instance (in a location where I did have write permission) . Using syslog-ng-ctl with this control file, I was able to finally see some helpful output on logs that were processed and/or dropped by syslog-ng. Still working on figuring out the root cause behind why logs aren't being processed by syslog-ng, but getting syslog-ng-ctl to work correctly has assisted greatly with troubleshooting. Thanks again! -Andrew