THanks, I've actually tried it both ways, neither would work but I'm trying to match SYS-5-CONFIG just so I can initiate a config pull based on in. I don't need everything. ... View more

Hi Guys - thanks for your comments up to now, I've managed to get back to this. So I've configured as per below but it's still not working, and I've no idea where to start looking for the reason why? I've also enabled the heavyforwarder. I'd appreciate some guidance, even if you just tell me where to look for some clues? ................................................. outputs.conf [syslog:MY_GROUP] disabled = false server = :514 ................................................. props.conf [syslog] TRANSFORMS-fwdsyslog = send_to_ncm ................................................. transforms.conf [send_to_ncm] REGEX = SYS-5-CONFIG DEST_KEY = _SYSLOG_ROUTING FORMAT = MY_GROUP ... View more

Thanks guys, but how do I know if I have a heavy forwarder or not? ... View more