Jernej,
What happens when you use
file("$HOST/$PROGRAM/$YEAR_$MONTH" create_dirs(yes));
with your "fix" ? Will i still get logs from "Message" ? (yes...running AIX. :-/)
I tested this destination under both the original and altered versions of syslog-ng, and could see no difference in the way files were created. However, from both I did see results I would neither expect nor desire. As you can see from the results of a "find ." execution at the root of the directory tree used by syslog-ng for the destination: d_test { file("/logs/test/$HOST/$PROGRAM/$YEAR_$MONTH" create_dirs(yes));}; is: . ./aaaa.bbbb.cornell.edu ./aaaa.bbbb.cornell.edu/At ./aaaa.bbbb.cornell.edu/At/2000_09 ./aaaa.bbbb.cornell.edu/--syslog ./aaaa.bbbb.cornell.edu/--syslog/2000_09 ./cccc.dddd.cornell.edu ./cccc.dddd.cornell.edu/dhcpd ./cccc.dddd.cornell.edu/dhcpd/2000_09 ./eeee.dddd.cornell.edu ./eeee.dddd.cornell.edu/forwarded from eeee ./eeee.dddd.cornell.edu/forwarded from eeee/2000_09 ./ffff.bbbb.cornell.edu ./ffff.bbbb.cornell.edu/--syslog ./ffff.bbbb.cornell.edu/--syslog/2000_09 ./ffff.bbbb.cornell.edu/At ./ffff.bbbb.cornell.edu/At/2000_09 ./gggg.dddd.cornell.edu ./gggg.dddd.cornell.edu/13125 ./gggg.dddd.cornell.edu/13125/2000_09 ./gggg.dddd.cornell.edu/13126 ./gggg.dddd.cornell.edu/13126/2000_09 ./gggg.dddd.cornell.edu/13127 ./gggg.dddd.cornell.edu/13127/2000_09 ./gggg.dddd.cornell.edu/13128 ./gggg.dddd.cornell.edu/13128/2000_09 ./hhhh.iiii.cornell.edu ./hhhh.iiii.cornell.edu/forwarded from hhhh ./hhhh.iiii.cornell.edu/forwarded from hhhh/2000_09 ./jjjj ./jjjj/sudo ./jjjj/sudo/2000_09 ./kkkk.dddd.cornell.edu ./kkkk.dddd.cornell.edu/dhcpd ./kkkk.dddd.cornell.edu/dhcpd/2000_09 ./llll.dddd.cornell.edu ./llll.dddd.cornell.edu/sendmail ./llll.dddd.cornell.edu/sendmail/2000_09 ./mmmm.bbbb.cornell.edu ./mmmm.bbbb.cornell.edu/At ./mmmm.bbbb.cornell.edu/At/2000_09 ./nnnn.dddd.cornell.edu ./nnnn.dddd.cornell.edu/forwarded from nnnn ./nnnn.dddd.cornell.edu/forwarded from nnnn/2000_09 Directories like: "/forwarded from nnnn/" are not good for us. Additionally, I did not see any "Message" directories, but only let the test run for a few minutes. I really don't know for sure whether what I changed might break other functions. I think only Bazsi can make that observation. John --- John A. Parker Senior Programmer/Analyst - AIX Cornell University jap54@cornell.edu 607-255-9356 607-255-8521 (Fax)