Why not stand up a test server and add it to the logging configs of the non-working and a couple of working switches? It could be a VM, since it won't have much load. You could also capture the log messages and play them back at the test server without impacting your production server or data archives. -tcs On 2/18/14 3:12 PM, syslog-ng-request@lists.balabit.hu wrote:

Date: Tue, 18 Feb 2014 15:12:50 -0500 From: Chris Moody<chris@node-nine.com> Subject: [syslog-ng] need help debugging some network received logs that aren't writing to files To: Syslog-ng users' and developers' mailing list <syslog-ng@lists.balabit.hu> Message-ID:<5303BEC2.9010405@node-nine.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed

Hello.

First off, thanks a __TON__ for syslog-ng. I've sworn by this awesome code for years now. I've built all sorts of logging infrastructure with it.

I seem to have hit on something though that's got me scratching my head and lacking for explanation. Perhaps I've just been staring at it and debugging it too long and am missing something obvious.

-- Terry Slattery CCIE# 1026