At 03:52 PM 3/12/2011, you wrote: >That probably means that it's not syslog-ng causing the problems. right >Maybe some firewall rule? I run pf. pfctl -d didn't allow logging to start. trafshow and tshark showed all the traffic hitting port 514, not being blocked. Len