I have been running with: file("/var/log/syslog-ng/$YEAR-$MONTH-$DAY/$HOST.log" dir_owner("root") dir_group("adm") dir_perm(0 750) owner("root") group("adm") perm(0640) create_dirs(yes)); (or $PROGRAM instead of $HOST), but still get some log events in: /var/log/syslog-ng/$YEAR-$MONTH-$DAY/$FACILITY.log?! daemon.log: Mar 28 11:48:42 log_source@pawan dhcpd: Wrote 8 leases to leases file mail.log: Mar 28 00:04:14 log_source@pawan amavis[6299]: (06299-03) Passed, <bounce-debian-devel=allanwind=lifeintegrity. com@lists.debian.org> -> <allanwind@lifeintegrity.com>, Message-ID: <87r7vdsgum.fsf@mrvn.homelinux.org>, Hits: -4.9 syslog.log: Mar 28 00:01:05 internal_source@pawan syslog-ng[341]: STATS: dropped 0 My syslog-ng.conf is pretty complicated as I use it to filter my logs real-time, but it looks something like this: # sources # source internal_source { internal(); }; source log_source { unix-stream("/dev/log"); }; source kmsg_source { file("/proc/kmsg" log_prefix("kernel: ")); }; destination syslog_destination { file("/var/log/syslog-ng/$YEAR-$MONTH-$DAY/$HOST.log" dir_owner("root") dir_group("adm") dir_perm(0750) owner("root") group("adm") perm(0640) create_dirs(yes)); }; # log paths # log { source(internal_source); source(log_source); source(kmsg_source); destination(syslog_destination); }; /Allan -- Allan Wind P.O. Box 2022 Woburn, MA 01888-0022 USA