Hi, I am trying to setup a syslog-ng architecture with a relay. Here is an example : Linux Host1 logs messages to syslog with facility user.info on Host1, syslog-ng is set up to forward these messages (with a filter based on the facility) to Host2 via UDP Linux Host2(log collector)'s syslog-ng is configured to listen for incoming udp packets, and forward them to a Windows Host3 after changing the message's format thanks to a template (add the Source IP at the beginning of the message) Windows Host3 processes the incoming udp messages. I have managed to make it work, that is, messages generated on Host1 with the logger command are successfully received on Host3. Nevertheless, it looks like all the messages reaching my Host3 have the facility/priority User.notice, instead of the original one. Here are some parts of my configuration : -------on Host1: #filter for user facility - for tests filter f_user {facility(user); }; destination host2 {udp("IP.Address.of.Host2");}; log{ source(src); filter(f_user);destination( host2 ); }; ------on Host2 # syslog full redirection to Thibaud's machine destination host3 { udp("IP.ADDRESSE:OF:HOST" template("$SOURCEIP $MSG\n")); }; source s_udp {udp();}; log { source(s_udp); destination ( host3 ); }; I generate messages on host1 with the command logger -p user.warning "message warning test" Is there anything I am doing wrong? Could changing the template make the message lose information about Facility and Level? Thanks in advance