Hi Balazs As requested.... 0x0000: 4500 0164 68db 0000 3f11 7baa ac16 0078 E..dh...?.{....x 0x0010: c0a8 28cd 0bfa 0202 0150 9f48 3c31 3635 ..(......P.H<165 0x0020: 3e64 652d 6777 2d31 3a20 4e65 7453 6372

de-gw-1:.NetScr 0x0030: 6565 6e20 6465 7669 6365 5f69 643d 6465 een.device_id=de 0x0040: 2d67 772d 3120 205b 4e6f 204e 616d 655d -gw-1..[No.Name] 0x0050: 7379 7374 656d 2d6e 6f74 6966 6963 6174 system-notificat 0x0060: 696f 6e2d 3030 3235 3728 7472 6166 6669 ion-00257(traffi 0x0070: 6329 3a20 7374 6172 745f 7469 6d65 3d22 c):.start_time=" 0x0080: 3230 3034 2d31 312d 3232 2031 373a 3035 2004-11-22.17:05 0x0090: 3a30 3622 2064 7572 6174 696f 6e3d 3220 :06".duration=2. 0x00a0: 706f 6c69 6379 5f69 643d 3120 7365 7276 policy_id=1.serv 0x00b0: 6963 653d 6874 7470 2070 726f 746f 3d36 ice=http.proto=6 0x00c0: 2073 7263 207a 6f6e 653d 5472 7573 7420 .src.zone=Trust. 0x00d0: 6473 7420 7a6f 6e65 3d55 6e74 7275 7374 dst.zone=Untrust 0x00e0: 2061 6374 696f 6e3d 5065 726d 6974 2073 .action=Permit.s 0x00f0: 656e 743d 3636 3120 7263 7664 3d39 3434 ent=661.rcvd=944 0x0100: 2073 7263 3d31 3732 2e32 322e 302e 3233 .src=XXX.XX.X.XX 0x0110: 2064 7374 3d36 362e 3136 332e 3137 352e .dst=XX.XXX.XXX. 0x0120: 3132 3820 7372 635f 706f 7274 3d33 3930 XXX.src_port=390 0x0130: 3020 6473 745f 706f 7274 3d38 3020 7372 0.dst_port=80.sr 0x0140: 632d 786c 6174 6564 2069 703d 3231 372e c-xlated.ip=XXX. 0x0150: 3135 312e 3234 302e 3320 706f 7274 3d32 XXX.XXX.X.port=2 0x0160: 3939 3600 996.

I read about that Netscreen problem too, but I have a colleague who has exactly the same syslog-ng.conf entries and Netscreen OS version, and his works! I think Netscreen fixed that issue a while back, my issue occurs with at least 3 different Netscreen OS version. Thanks James Masson