February 2004 - syslog-ng - lists.balabit.hu

RE: [syslog-ng]$HOST $YEAR, etc not working correctly..
by Doug Peterson 04 Mar '04

04 Mar '04

More Info.. Linux Kernel 2.4.20-30.9smp 1.6.0rc4 produces the same results 1.6.0rc2 ignores $HOST/$YEAR/$MONTH completely (even in the directory structure), so therefore dumps all files in /var/log/hosts with messages_24 ($DAY still works) __________________________________ Do you Yahoo!? Yahoo! Mail SpamGuard - Read only the mail you want. http://antispam.yahoo.com/tools

3 7

Current stable syslog-ng + libol
by Loic Minier 01 Mar '04

01 Mar '04

Hey, (Thank you for syslog-ng.) I'd like to build the current stable version of syslog-ng, I've seen syslog-ng-1.4.17 on the balabit's website (following the "stable" link) and built with libol-0.2.24 (following INSTALL's instructions). However, Freshmeat has 1.5 as stable and 1.9 as dev, Debian has 1.5 as stable, 1.6 in testing and unstable, ... What versions are considered "stable"? I particularly need template() which doesn't fit in the conf -- neither does log_msg_size() -- right now. While we're at it, what is the appropriate version of libol for this syslog-ng? Regards, -- Loïc Minier <lool(a)dooz.org>

2 3

sylog-ng file() options
by Coward, Robert (Contractor) 29 Feb '04

29 Feb '04

Are there any plans to implement the compress() and encrypt() options for the file() driver? Roberto

2 1

RE: [syslog-ng]$HOST $YEAR, etc not working correctly..
by Kelly, Chuck 26 Feb '04

26 Feb '04

My point being try separating the lines out, I do a similar thing with no issues, but keep destinations within their own set of {} -- Chuck -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Doug Peterson Sent: Tuesday, February 24, 2004 2:43 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]$HOST $YEAR, etc not working correctly.. Howdy, I recently installed the same config file I had in 1.6.0rc1(or rc2?) on redhat 7.3 to a system with syslog-ng 1.6.2 with redhat 9... My log files are not being written in the format that I would expect (or that they WERE on the old box).. I would expect the following rule to write to the file: /var/log/hosts/webserver1/2004/02/24/webserver1_messages_2004_02_24 Instead I get: /var/log/hosts/webserver1/2004/02/24/messsages_24 The rule: destination messages.network { file("/var/log/hosts/$HOST/$YEAR/$MONTH/$DAY/$HOST_messages_$YEAR_$MONTH _$DAY" owner(root) group(sysadmin) perm(0640) dir_perm(0700) create_dirs(yes) ); }; This happens with all similar destination rules. The $year, $month, $host, etc work fine in the first portion of the destination, but they don't all work in the filename.. but $day does for some strange reason. I can provide my full 164 line config file on request, but all destinations are setup the same as this one, and all get the same result. What am I missing here? :) __________________________________ Do you Yahoo!? Yahoo! Mail SpamGuard - Read only the mail you want. http://antispam.yahoo.com/tools _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

3 2

RE: [syslog-ng]syslog duplicate entries
by Hamilton Andrew 25 Feb '04

25 Feb '04

Yep. Drew -----Original Message----- From: Dylan Bouterse [mailto:dbouterse@globalcardservices.com] Sent: Tuesday, February 24, 2004 5:46 PM To: 'syslog-ng(a)lists.balabit.hu' Subject: RE: [syslog-ng]syslog duplicate entries Should I be able to remove all of the destination lines following std and still get the localhost's log information to it's host directory based on the "destination std" line? Dylan -----Original Message----- From: Hamilton Andrew [mailto:Andrew.Hamilton@afccc.af.mil] Sent: Tuesday, February 24, 2004 12:33 PM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]syslog duplicate entries Look at your filter, f_syslog, destination d_syslog, and your log line that includes d_syslog. Your filter f_syslog includes everything except facilities auth, and authpriv. If you are confident that you don't need your syslog line you can comment that out as well to keep you from getting duplicates in you /var/log/syslog file. Regards, Drew -----Original Message----- From: Dylan (FHMS) [ mailto:dhbouterse@fhmsi.com <mailto:dhbouterse@fhmsi.com> ] Sent: Tuesday, February 24, 2004 12:25 PM To: 'syslog-ng(a)lists.balabit.hu' Subject: [syslog-ng]syslog duplicate entries I have my syslog-ng setup so that external syslog hosts are creating their own dir and log file (see conf file below). One problem I'm having is that all of the hosts' logs are being written to /var/log/syslog as well...creating a 6Gig file or larger per week. Can someone please point out what I can change with my conf file to eliminate the duplicate entries? Thank you! Dylan ############################################# ### syslog-ng.conf file ############################################# options { check_hostname(yes); chain_hostnames(no); create_dirs (yes); dir_perm(0755); dns_cache(yes); keep_hostname(yes); log_fifo_size(2048); log_msg_size(8192); long_hostnames(on); perm(0644); stats(3600); sync(0); time_reopen (10); use_dns(yes); use_fqdn(no); }; # # This is the default behavior of sysklogd package # Logs may come from unix stream, but not from another machine. # #source src { unix-dgram("/dev/log"); internal(); }; # # If you wish to get logs from remote machine you should uncomment # this and comment the above source line. # source src { unix-dgram("/dev/log"); internal(); udp(); tcp(port(514) keep-alive(yes) max-connections(25));}; destination std { # file("/var/log/HOSTS/$YEAR/$HOST/$MONTH/$FACILITY_$HOST_$YEAR_$MONTH_$DAY" file("/var/log/HOSTS/$HOST/$HOST.syslog" owner(nagios) group(nagios) perm(0600) dir_perm(0700) create_dirs(yes) ); }; # After that set destinations. # First some standard logfile # destination authlog { file("/var/log/auth.log" owner("root") group("adm") perm(0640)); }; destination syslog { file("/var/log/syslog" owner("root") group("adm") perm(0640)); }; destination cron { file("/var/log/cron.log" owner("root") group("adm") perm(0640)); }; destination daemon { file("/var/log/daemon.log" owner("root") group("adm") perm(0640)); }; destination kern { file("/var/log/kern.log" owner("root") group("adm") perm(0640)); }; destination lpr { file("/var/log/lpr.log" owner("root") group("adm") perm(0640)); }; destination mail { file("/var/log/mail.log" owner("root") group("adm") perm(0640)); }; destination user { file("/var/log/user.log" owner("root") group("adm") perm(0640)); }; destination uucp { file("/var/log/uucp.log" owner("root") group("adm") perm(0640)); }; # This files are the log come from the mail subsystem. # destination mailinfo { file("/var/log/mail.info" owner("root") group("adm") perm(0640)); }; destination mailwarn { file("/var/log/mail.warn" owner("root") group("adm") perm(0640)); }; destination mailerr { file("/var/log/mail.err" owner("root") group("adm") perm(0640)); }; # Logging for INN news system # destination newscrit { file("/var/log/news/news.crit" owner("root") group("adm") perm(0640)); }; destination newserr { file("/var/log/news/news.err" owner("root") group("adm") perm(0640)); }; destination newsnotice { file("/var/log/news/news.notice" owner("root") group("adm") perm(0640)); }; # Some `catch-all' logfiles. # #destination debug { file("/var/log/debug" owner("root") group("adm") #perm(0640)); }; #destination messages { file("/var/log/messages" owner("root") group("adm") #perm(0640)); }; # The root's console. # destination console { usertty("root"); }; # Virtual console. # destination console_all { file("/dev/tty8"); }; # The named pipe /dev/xconsole is for the nsole' utility. To use it, # you must invoke nsole' with the -file' option: # # $ xconsole -file /dev/xconsole [...] # #destination xconsole { pipe("/dev/xconsole"); }; destination ppp { file("/var/log/ppp.log" owner("root") group("adm") perm(0640)); }; # Here's come the filter options. With this rules, we can set which # message go where. filter f_authpriv { facility(auth, authpriv); }; filter f_syslog { not facility(auth, authpriv); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_user { facility(user); }; filter f_uucp { facility(uucp); }; filter f_news { facility(news); }; filter f_debug { not facility(auth, authpriv, news, mail); }; filter f_messages { level(info .. warn) and not facility(auth, authpriv, cron, daemon, mail, news); }; filter f_emergency { level(emerg); }; filter f_info { level(info); }; filter f_notice { level(notice); }; filter f_warn { level(warn); }; filter f_crit { level(crit); }; filter f_err { level(err); }; filter f_cnews { level(notice, err, crit) and facility(news); }; filter f_cother { level(debug, info, notice, warn) or facility(daemon, mail); }; filter ppp { facility(local2); }; log { source(src); filter(f_authpriv); destination(authlog); }; log { source(src); filter(f_syslog); destination(syslog); }; #log { source(src); filter(f_cron); destination(cron); }; log { source(src); filter(f_daemon); destination(daemon); }; log { source(src); filter(f_kern); destination(kern); }; log { source(src); filter(f_lpr); destination(lpr); }; log { source(src); filter(f_mail); destination(mail); }; log { source(src); filter(f_user); destination(user); }; log { source(src); filter(f_uucp); destination(uucp); }; log { source(src); filter(f_mail); filter(f_info); destination(mailinfo); }; log { source(src); filter(f_mail); filter(f_warn); destination(mailwarn); }; log { source(src); filter(f_mail); filter(f_err); destination(mailerr); }; log { source(src); filter(f_news); filter(f_crit); destination(newscrit); }; log { source(src); filter(f_news); filter(f_err); destination(newserr); }; log { source(src); filter(f_news); filter(f_notice); destination(newsnotice); }; #log { source(src); filter(f_debug); destination(debug); }; #log { source(src); filter(f_messages); destination(messages); }; log { source(src); filter(f_emergency); destination(console); }; #log { source(src); filter(f_cnews); destination(console_all); }; #log { source(src); filter(f_cother); destination(console_all); }; ####log { source(src); filter(f_cnews); destination(xconsole); }; ###log { source(src); filter(f_cother); destination(xconsole); }; log { source(src); filter(ppp); destination(ppp); }; log { source(src); destination(std); }; _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng <https://lists.balabit.hu/mailman/listinfo/syslog-ng> Frequently asked questions at http://www.campin.net/syslog-ng/faq.html <http://www.campin.net/syslog-ng/faq.html>

1 0

Connection broken, line before lose
by Benoit DOLEZ 25 Feb '04

25 Feb '04

Hi, When a connection broken is detected (error when writing a line to an invalid socket), the line that make the "connection broken" to be detected is definitly lost. In a local file Feb 24 22:09:47 src@loki root: 10 11 12 13 14 15 16 17 18 19 20 21 22 23 Feb 24 22:09:48 src@loki root: 10 11 12 13 14 15 16 17 18 19 20 21 22 23 Feb 24 22:09:48 src@loki syslog-ng[18900]: Connection broken to AF_INET(127.0.0.1:40000), reopening in 60 seconds Feb 24 22:09:49 src@loki root: 10 11 12 13 14 15 16 17 18 19 20 21 22 23 In the remote process # nc -l -p 40000 (...) Feb 24 22:09:47 src@loki root: 10 11 12 13 14 15 16 17 18 19 20 21 22 23 <Ctrl-C> # nc -l -p 40000 <43>Feb 24 22:09:48 src@loki syslog-ng[18900]: Connection broken to AF_INET(127.0.0.1:40000), reopening in 60 seconds <13>Feb 24 22:09:49 src@loki root: 10 11 12 13 14 15 16 17 18 19 20 21 22 23 le log line at Feb 24 22:09:48 is definitly lost, is it normal? B DOLEZ -- Benoit DOLEZ, EXOSEC (http://www.exosec.fr/) 12 av des Pres - BL233, 78059 St Quentin en Yvelines cedex Tel: +33 1 61 37 05 35 - Fax: +33 1 61 38 10 65 GSM: +33 6 21 05 91 69 - mailto:bdolez@exosec.fr

2 1

RE: [syslog-ng]$HOST $YEAR, etc not working correctly..
by Kelly, Chuck 24 Feb '04

24 Feb '04

I left off something on the end as well. destination messages.network { file("/var/log/hosts/$HOST/$YEAR/$MONTH/$DAY/$HOST_messages_$YEAR_$MONTH _$DAY"); }; -- Chuck -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Doug Peterson Sent: Tuesday, February 24, 2004 2:43 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]$HOST $YEAR, etc not working correctly.. Howdy, I recently installed the same config file I had in 1.6.0rc1(or rc2?) on redhat 7.3 to a system with syslog-ng 1.6.2 with redhat 9... My log files are not being written in the format that I would expect (or that they WERE on the old box).. I would expect the following rule to write to the file: /var/log/hosts/webserver1/2004/02/24/webserver1_messages_2004_02_24 Instead I get: /var/log/hosts/webserver1/2004/02/24/messsages_24 The rule: destination messages.network { file("/var/log/hosts/$HOST/$YEAR/$MONTH/$DAY/$HOST_messages_$YEAR_$MONTH _$DAY" owner(root) group(sysadmin) perm(0640) dir_perm(0700) create_dirs(yes) ); }; This happens with all similar destination rules. The $year, $month, $host, etc work fine in the first portion of the destination, but they don't all work in the filename.. but $day does for some strange reason. I can provide my full 164 line config file on request, but all destinations are setup the same as this one, and all get the same result. What am I missing here? :) __________________________________ Do you Yahoo!? Yahoo! Mail SpamGuard - Read only the mail you want. http://antispam.yahoo.com/tools _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]$HOST $YEAR, etc not working correctly..
by Kelly, Chuck 24 Feb '04

24 Feb '04

Try this. destination messages.network { file("/var/log/hosts/$HOST/$YEAR/$MONTH/$DAY/$HOST_messages_$YEAR_$MONTH _$DAY"); I added paren and semni-colon to end -- Chuck -----Original Message----- From: syslog-ng-admin(a)lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of Doug Peterson Sent: Tuesday, February 24, 2004 2:43 PM To: syslog-ng(a)lists.balabit.hu Subject: [syslog-ng]$HOST $YEAR, etc not working correctly.. Howdy, I recently installed the same config file I had in 1.6.0rc1(or rc2?) on redhat 7.3 to a system with syslog-ng 1.6.2 with redhat 9... My log files are not being written in the format that I would expect (or that they WERE on the old box).. I would expect the following rule to write to the file: /var/log/hosts/webserver1/2004/02/24/webserver1_messages_2004_02_24 Instead I get: /var/log/hosts/webserver1/2004/02/24/messsages_24 The rule: destination messages.network { file("/var/log/hosts/$HOST/$YEAR/$MONTH/$DAY/$HOST_messages_$YEAR_$MONTH _$DAY" owner(root) group(sysadmin) perm(0640) dir_perm(0700) create_dirs(yes) ); }; This happens with all similar destination rules. The $year, $month, $host, etc work fine in the first portion of the destination, but they don't all work in the filename.. but $day does for some strange reason. I can provide my full 164 line config file on request, but all destinations are setup the same as this one, and all get the same result. What am I missing here? :) __________________________________ Do you Yahoo!? Yahoo! Mail SpamGuard - Read only the mail you want. http://antispam.yahoo.com/tools _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

1 0

RE: [syslog-ng]syslog duplicate entries
by Dylan Bouterse 24 Feb '04

24 Feb '04

Should I be able to remove all of the destination lines following std and still get the localhost's log information to it's host directory based on the "destination std" line? Dylan -----Original Message----- From: Hamilton Andrew [mailto:Andrew.Hamilton@afccc.af.mil] Sent: Tuesday, February 24, 2004 12:33 PM To: syslog-ng(a)lists.balabit.hu Subject: RE: [syslog-ng]syslog duplicate entries Look at your filter, f_syslog, destination d_syslog, and your log line that includes d_syslog. Your filter f_syslog includes everything except facilities auth, and authpriv. If you are confident that you don't need your syslog line you can comment that out as well to keep you from getting duplicates in you /var/log/syslog file. Regards, Drew -----Original Message----- From: Dylan (FHMS) [ mailto:dhbouterse@fhmsi.com <mailto:dhbouterse@fhmsi.com> ] Sent: Tuesday, February 24, 2004 12:25 PM To: 'syslog-ng(a)lists.balabit.hu' Subject: [syslog-ng]syslog duplicate entries I have my syslog-ng setup so that external syslog hosts are creating their own dir and log file (see conf file below). One problem I'm having is that all of the hosts' logs are being written to /var/log/syslog as well...creating a 6Gig file or larger per week. Can someone please point out what I can change with my conf file to eliminate the duplicate entries? Thank you! Dylan ############################################# ### syslog-ng.conf file ############################################# options { check_hostname(yes); chain_hostnames(no); create_dirs (yes); dir_perm(0755); dns_cache(yes); keep_hostname(yes); log_fifo_size(2048); log_msg_size(8192); long_hostnames(on); perm(0644); stats(3600); sync(0); time_reopen (10); use_dns(yes); use_fqdn(no); }; # # This is the default behavior of sysklogd package # Logs may come from unix stream, but not from another machine. # #source src { unix-dgram("/dev/log"); internal(); }; # # If you wish to get logs from remote machine you should uncomment # this and comment the above source line. # source src { unix-dgram("/dev/log"); internal(); udp(); tcp(port(514) keep-alive(yes) max-connections(25));}; destination std { # file("/var/log/HOSTS/$YEAR/$HOST/$MONTH/$FACILITY_$HOST_$YEAR_$MONTH_$DAY" file("/var/log/HOSTS/$HOST/$HOST.syslog" owner(nagios) group(nagios) perm(0600) dir_perm(0700) create_dirs(yes) ); }; # After that set destinations. # First some standard logfile # destination authlog { file("/var/log/auth.log" owner("root") group("adm") perm(0640)); }; destination syslog { file("/var/log/syslog" owner("root") group("adm") perm(0640)); }; destination cron { file("/var/log/cron.log" owner("root") group("adm") perm(0640)); }; destination daemon { file("/var/log/daemon.log" owner("root") group("adm") perm(0640)); }; destination kern { file("/var/log/kern.log" owner("root") group("adm") perm(0640)); }; destination lpr { file("/var/log/lpr.log" owner("root") group("adm") perm(0640)); }; destination mail { file("/var/log/mail.log" owner("root") group("adm") perm(0640)); }; destination user { file("/var/log/user.log" owner("root") group("adm") perm(0640)); }; destination uucp { file("/var/log/uucp.log" owner("root") group("adm") perm(0640)); }; # This files are the log come from the mail subsystem. # destination mailinfo { file("/var/log/mail.info" owner("root") group("adm") perm(0640)); }; destination mailwarn { file("/var/log/mail.warn" owner("root") group("adm") perm(0640)); }; destination mailerr { file("/var/log/mail.err" owner("root") group("adm") perm(0640)); }; # Logging for INN news system # destination newscrit { file("/var/log/news/news.crit" owner("root") group("adm") perm(0640)); }; destination newserr { file("/var/log/news/news.err" owner("root") group("adm") perm(0640)); }; destination newsnotice { file("/var/log/news/news.notice" owner("root") group("adm") perm(0640)); }; # Some `catch-all' logfiles. # #destination debug { file("/var/log/debug" owner("root") group("adm") #perm(0640)); }; #destination messages { file("/var/log/messages" owner("root") group("adm") #perm(0640)); }; # The root's console. # destination console { usertty("root"); }; # Virtual console. # destination console_all { file("/dev/tty8"); }; # The named pipe /dev/xconsole is for the nsole' utility. To use it, # you must invoke nsole' with the -file' option: # # $ xconsole -file /dev/xconsole [...] # #destination xconsole { pipe("/dev/xconsole"); }; destination ppp { file("/var/log/ppp.log" owner("root") group("adm") perm(0640)); }; # Here's come the filter options. With this rules, we can set which # message go where. filter f_authpriv { facility(auth, authpriv); }; filter f_syslog { not facility(auth, authpriv); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_user { facility(user); }; filter f_uucp { facility(uucp); }; filter f_news { facility(news); }; filter f_debug { not facility(auth, authpriv, news, mail); }; filter f_messages { level(info .. warn) and not facility(auth, authpriv, cron, daemon, mail, news); }; filter f_emergency { level(emerg); }; filter f_info { level(info); }; filter f_notice { level(notice); }; filter f_warn { level(warn); }; filter f_crit { level(crit); }; filter f_err { level(err); }; filter f_cnews { level(notice, err, crit) and facility(news); }; filter f_cother { level(debug, info, notice, warn) or facility(daemon, mail); }; filter ppp { facility(local2); }; log { source(src); filter(f_authpriv); destination(authlog); }; log { source(src); filter(f_syslog); destination(syslog); }; #log { source(src); filter(f_cron); destination(cron); }; log { source(src); filter(f_daemon); destination(daemon); }; log { source(src); filter(f_kern); destination(kern); }; log { source(src); filter(f_lpr); destination(lpr); }; log { source(src); filter(f_mail); destination(mail); }; log { source(src); filter(f_user); destination(user); }; log { source(src); filter(f_uucp); destination(uucp); }; log { source(src); filter(f_mail); filter(f_info); destination(mailinfo); }; log { source(src); filter(f_mail); filter(f_warn); destination(mailwarn); }; log { source(src); filter(f_mail); filter(f_err); destination(mailerr); }; log { source(src); filter(f_news); filter(f_crit); destination(newscrit); }; log { source(src); filter(f_news); filter(f_err); destination(newserr); }; log { source(src); filter(f_news); filter(f_notice); destination(newsnotice); }; #log { source(src); filter(f_debug); destination(debug); }; #log { source(src); filter(f_messages); destination(messages); }; log { source(src); filter(f_emergency); destination(console); }; #log { source(src); filter(f_cnews); destination(console_all); }; #log { source(src); filter(f_cother); destination(console_all); }; ####log { source(src); filter(f_cnews); destination(xconsole); }; ###log { source(src); filter(f_cother); destination(xconsole); }; log { source(src); filter(ppp); destination(ppp); }; log { source(src); destination(std); }; _______________________________________________ syslog-ng maillist - syslog-ng(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng <https://lists.balabit.hu/mailman/listinfo/syslog-ng> Frequently asked questions at http://www.campin.net/syslog-ng/faq.html <http://www.campin.net/syslog-ng/faq.html>

1 0

$HOST $YEAR, etc not working correctly..
by Doug Peterson 24 Feb '04

24 Feb '04

Howdy, I recently installed the same config file I had in 1.6.0rc1(or rc2?) on redhat 7.3 to a system with syslog-ng 1.6.2 with redhat 9... My log files are not being written in the format that I would expect (or that they WERE on the old box).. I would expect the following rule to write to the file: /var/log/hosts/webserver1/2004/02/24/webserver1_messages_2004_02_24 Instead I get: /var/log/hosts/webserver1/2004/02/24/messsages_24 The rule: destination messages.network { file("/var/log/hosts/$HOST/$YEAR/$MONTH/$DAY/$HOST_messages_$YEAR_$MONTH_$DAY" owner(root) group(sysadmin) perm(0640) dir_perm(0700) create_dirs(yes) ); }; This happens with all similar destination rules. The $year, $month, $host, etc work fine in the first portion of the destination, but they don't all work in the filename.. but $day does for some strange reason. I can provide my full 164 line config file on request, but all destinations are setup the same as this one, and all get the same result. What am I missing here? :) __________________________________ Do you Yahoo!? Yahoo! Mail SpamGuard - Read only the mail you want. http://antispam.yahoo.com/tools

1 0