I've got syslog-ng v 1.6.4 compiled with tcp_wrapper support and tried to block a particular ipaddress in hosts.deny Does the syslog-ng daemon have to be started from inetd for this to work? Does syslog-ng use tcp_wrappers for UDP traffic also?