I have configured my local client and my loghost to use syslog-ng v 1.3.10. The client is setup to send all syslog messages to the loghost and the loghost then breaks them apart mainly by facility. What I am seeing is that when I issue a "logger -p kern.notice testing kern.notice" it shows up locally as a user message. Here is the client config file: source local { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; destination all { file("/var/log/messages"); }; filter kernfilter { facility(kern); }; filter f_user { facility(user); }; destination loghost { udp("sysloguser" port(514)); }; destination ttys { usertty("*"); }; destination kern { file ("/var/log/kern"); }; destination user { file ("/var/log/user"); }; log { source(local); destination(all); }; log { source(local); destination(loghost); }; log { source(local); filter(kernfilter); destination(kern); }; log { source(local); filter(f_user); destination(user); }; -- John C. Wingenbach Broadband Technologies Sr. Systems Administrator Work: (919) 405-4627 Fax: (919) 405-4544