To which facility go internal() messages ? Here is my box config : Debian Linux running provided syslogd/klogd syslog-ng 1.5.21 chrooted running as a log collector for all others box in the lan the debian provided syslogd also redirect all his messages to the log collector (this piggy conf will be cleaned soon. Only syslog-ng will stay) - - syslog-ng.conf - - options { use_dns(yes); chain_hostnames(no); sync(0); }; source s_internal { internal(); }; source s_net { udp( ip(192.168.12.2) port(514) ); }; source s_ntpd { unix-stream("/chroot/ntpd/dev/log"); }; destination d_hosts { file( "/var/log/$HOST/$YEAR/$MONTH/$DAY/$FACILITY"\ create_dirs(yes) owner("root") group("root")\ perm(0600) dir_perm(0700) ); }; log { source(s_internal); source(s_net); source(s_ntpd); destination(d_hosts); }; - - syslog-ng.conf - - when grepping syslog from /var/log/MyBox/*/*/*/* I attempted to find some messages about syslog-ng. But no the only syslog occurences found only refers to debian provided syslog Where can I find internal syslog-ng messages ? Thanks