I created rules in the config file: filter f_cron_pam { match("crond(pam_unix)"); }; log { source(s_sys); filter(f_cron_pam); \ destination(d_auth); flags(final); }; And yet, these messages still go into /var/log/messages! Why? Weird! If I make a logger test message, like logger "crond(pam_unix) test" they go into /var/log/messages. Maybe my match is wrong? Do I need to escape some of the characters perhaps? Abkhan wrote:

These are pam-authentication module messages .

__________________________________ Do you Yahoo!? Take Yahoo! Mail with you! Get it on your mobile phone. http://mobile.yahoo.com/maildemo _______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html