<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class="">Hi All,</div><div class="">I am experiencing a weird problem with Syslog-NG 3.8.1 on Ubuntu 14.04</div><div class=""><br class=""></div><div class="">When syslog receives syslog messages from couple of specific nodes it saves it on a destination folder as per the config below:</div><div class=""><br class=""></div><div class=""><div class="">source s_rohnet {</div><div class=""> network(</div><div class=""> transport("udp")</div><div class=""> );</div><div class="">};</div><div class=""><br class=""></div><div class="">destination d_rohnet_switches {</div><div class=""> file("/var/log/ROHNetwork/${YEAR}.${WEEK}/${HOST}.log" create-dirs(yes) dir-owner("rohadmin"));</div><div class="">};</div></div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">The devices are NTP synchronised and the date output is correct on the Ubuntu server:</div><div class=""><br class=""></div><div class="">>date<div class=""><br class=""></div><div class="">Tue Nov 22 11:21:14 GMT 2016</div></div><div class=""><br class=""></div><div class="">Beside these the log folders created where the files gets stored are: <b class="">/2015.51</b>/192.168.33.8.log (it should be /<b class="">2016.47</b>/).</div><div class=""><br class=""></div><div class="">This is happening only for two nodes while all the rest seems to work fine.</div><div class=""><br class=""></div><div class="">I have captured some network traffic and the message received by syslog-ng on the network card seems also correct as per Wireshark output:</div><div class=""><br class=""></div><div class="">Syslog message: LOCAL6.NOTICE: NOV 22 10:31:23 192.168.33.8-1 CMDLOGGER[165319912]: cmd_logger_api.c(83) 13518 %% CLI:192.168.32.100:root:User logged in</div><div class=""><br class=""></div><div class="">This is a Dell switch and I am opening a case with them but I would like to know where else I should check for configuration errors.</div><div class=""><br class=""></div><div class="">Syslog config is exactly the one reported above.</div><div class=""><br class=""></div><div class="">Any idea of what I could check for further troubleshooting on the Syslog side? </div><div class=""><br class=""></div><div class="">Thanks,</div><div class="">Marco</div></body></html>