[LMStone]

Updating this thread with info to cover ZCS 6.0.x and SLES10...

Now that the old ZCS stats logging system has been replaced and there are now two Zimbra log files in /var/log, we found we needed to update /etc/syslog-ng/syslog.conf as follows.

Also, the newly defined "zimbra_src" didn't work, so we just commented that out and replaced "zimbra_src" in the log lines with the SuSE-defined "src".

Here's tail end of the /etc/syslog-ng/syslog.conf file we now use:

#source zimbra_src {  unix-stream("/dev/log"; keep-alive(yes); max-connections(20);); }; # zimbra
#source zimbra_src { unix-stream("/dev/log" keep-alive(yes)  max-connections(20)); }; # zimbra
filter zimbra_local0 { facility(local0); }; # zimbra
filter zimbra_local1 { facility(local1); }; # zimbra
filter zimbra_auth { facility(auth); }; # zimbra
filter zimbra_mail { facility(mail); }; # zimbra
destination zimbra_mail { file("/var/log/zimbra.log" owner("zimbra")); }; # zimbra
destination zimbra_local1 { file("/var/log/zimbra-stats.log" owner("zimbra")); }; # zimbra
destination zimbra_local0 { file("/var/log/zimbra.log" owner("zimbra")); }; # zimbra
destination zimbra_auth { file("/var/log/zimbra.log" owner("zimbra")); }; # zimbra
log { source(src); filter(zimbra_mail); destination(zimbra_mail); }; # zimbra
log { source(src); filter(zimbra_local0); destination(zimbra_local0); }; # zimbra
log { source(src); filter(zimbra_local1); destination(zimbra_local1); }; # zimbra
log { source(src); filter(zimbra_auth); destination(zimbra_auth); }; # zimbra

Hope that helps,
Mark