Ok, I can't quite figure out how to make this work. I want to simultaneously log everything for facility local5 in a local file and a remote syslog-ng server. local7 is working fine getting the boot.log log entries transferred over to the syslog-ng server, but not so much with local5. Local logging of local5.* on the client is working fine now. SERVER: /etc/syslog-ng/syslog-ng.conf (excerpt below) options { log_fifo_size(8192); # garden gnomes shouldn't log (Gnome has a buggy log implementation) # needs to be set on client systems, too... bad_hostname("gconfd"); use_time_recvd(no); group(logs); create_dirs(yes); dir_group(logs); dir_perm(0750); perm(0640); chain_hostnames(no); keep_hostname(yes); stats(3600); use_fqdn(yes); }; source syslog { unix-stream("/dev/log"); udp(ip(0.0.0.0) port(514)); tcp(ip(0.0.0.0) port(5149) max-connections(300)); internal(); }; destination mylogfile.log { file(/var/log/syslog-ng/$HOST/mylogfile.log); }; destination boot.log { file(/var/log/syslog-ng/$HOST/boot.log); }; filter f_local7 { facility(local7); }; filter f_local5 { facility(local5); }; log { source(syslog); filter(f_local7); destination(boot.log); }; log { source(syslog); filter(f_local5); destination(mylogfile.log); }; CLIENT /etc/syslog.conf excerpt *.* @syslogngbox local7.* /var/log/boot.log local5.* /var/log/mylogfile.log