You've got your destination path wrong, it's pointed to /var/$hostname/log instead of /var/log/$hostname. Here take a look: Change it to this:destination d_syslog { file("/var/log/$HOST/syslog" suppress(15)); };