The basic idea behind this is quite simple. It simple simply a preference shared amongst the developers of the distribution and its software packages. I don't think you'll find a document providing you with reason for the differences, as they are purely cosmetic, however if you read up on the logging mechanisms for a specific distribution you should be able to find or deduce information regarding that specific distro's logic in choosing its log file naming scheme. In the end as you mentioned, it is up to you how you choose you log file naming scheme. Common sense is usually a good place to start, such as avoiding logging kernel logs to a file called 'maillog.log' or 'access.log'. Hope this helps, Justin. -----Original Message----- From: Zoilo Gomez [mailto:zoilo@xs4all.nl] Sent: Friday, January 05, 2007 9:31 AM To: syslog-ng@lists.balabit.hu Subject: [syslog-ng] why /var/log/syslog, /var/log/messages etc I would be interested in a link to a document, explaining what is the idea behind log-files like /var/log/syslog and /var/log/messages etc, and why some information is often being written to 2 or more files instead of 1. And why some distros will log DHCP-messages to /var/log/daemon.log, while others will use a different log file. Of course I know that this is all up to myself to decide, but I would like to understand better what is the reasoning behind the various options. Z. _______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html