For the sake of the mailing list archives / google searches, the following flags() argument is needed to parse the new message format from local socket: source src { unix-dgram("/var/run/log" flags(syslog-protocol) ); unix-dgram("/var/run/logpriv" perm(0600)); internal(); file("/dev/klog"); }; Also, syslog-ng v. 3 or greater is needed (1.6x in pkgsrc, 2.x in pkgsrc-wip) If/when Other*BSD imports the IETF syslog support, the same will be true there. ~BAS