I'm running syslog-ng 3.03 on a RHEL5 system, sending logs to various files like so: # global log files destination deservers { file("/var/log/$HOST.log" owner(root) group(hobbit) perm(0640)); }; It's working fine on the Linux boxes. But I'm using Adiscon's EventLog on my Windows machines, and the $HOST name on them are coming up in all caps. [root@buran log]# ls -la /var/log/*.log ... -rw-r----- 1 root hobbit 282 Nov 4 14:37 /var/log/KANTECH.log -rw-r----- 1 root hobbit 535181 Nov 4 14:24 /var/log/PLCDATA.log Where's this $HOST macro get its data from? The DNS entry is lower case; the full computer name on the Windows box is lower case. I don't see where the upper is coming from, unless it's one of those weird Windows-to-Unix translation things. Not a big deal, but a bit of an annoyance. Thanks for any help. -- Tim Boyer Denman Tire Corporation