What I am missing here on FC6 in syslog.conf # Log anything (except mail) of level info or higher. # Don't log private authentication messages! *.info;mail.none;authpriv.none;cron.none /var/log/messages, at loghost Write messages to "/var/log/messages, at loghost" instead of "/var/log/messages" and forwarding to loghost. TIA Steve