Hey, hey! It's working! Someone had asked for the info once I got it working, so here is what I have. Pix firewall: logging host inside (IP of host workstation) logging timestamp logging trap 0-7 (here is a link that explains it http://www.siliconvalleyccie.com/cisco-hn/syslog-cisco.htm) logging timestamp logging trap notifications logging on /etc/sysconfig/syslog: Change line to look like this SYSLOGD_OPTIONS="-m 0 -r" In /var/log: mkdir pix touch /var/lg/pix/pix.log in /etc/syslog.conf add the following: local4.* /var/log/pix/pix.log restart syslog: service syslog restart Now you too are an expert like me:) Thanks everyone for the help! _______________________________________________ TCLUG Mailing List - Minneapolis/St. Paul, Minnesota http://www.mn-linux.org tclug-list at mn-linux.org https://mailman.real-time.com/mailman/listinfo/tclug-list