I have about 20 or so AIX 4.3 servers that are sending syslog messages to a Linux desktop running syslog-ng 1.6.5. Every now and then I get a message that does not contain the TAG information or process ID information. When I check the local /var/adm/messages file on the AIX server, the TAG information is intact. An example of an intact message on an AIX server is: Jun 13 09:57:11 myhost dbc4 : 3 TRANSACT 0 0 33686 57:11.60 An example of the same message on my syslog server after syslog-ng gets a hold of it: Jun 13 09:57:11 myhost : 3 TRANSACT 0 0 33686 57:11.60 As you can see I am losing the dbc4, why? Could it be because of the spaces after the dbc4 string? According to RFC 3164, a space should simply terminate the TAG field and begin the content portion of the message. Am I misunderstanding how this works? Thanks Alex This e-mail contains Omaha Public Power District's confidential and proprietary information and is for use only by the intended recipient. Unless explicitly stated otherwise, this e-mail is not a contract offer, amendment, nor acceptance. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.