Hi, I'm running syslog-ng server with a SSL tunnel to the syslog-ng client's I'm sorting the log files to the following dir destination extern { file( "/var/logs/$HOST/$DAY/$FACILITY.log"); }; That function works fine but in the log file there is the following line: Mar 28 03:01:26 src@XXX/ZZZZ.bos.nl proftpd[3808]: XXXX.bos.nl (ZZZZ.bos.nl[195.XX.XX.XX]) - FTP session closed. But i want the same line as with syslog Mar 28 03:01:26 XXX proftpd[3808]: XXXX.bos.nl (ZZZZ.bos.nl[195.XX.XX.XX]) - FTP session closed. So that the log analyzer can do there work, i know that i can put out that function with long_hostnames(off) but then is the sorting function for the directory's also gone is there a solution for this. Dennis Kruyt, ZXFactory BV Telefoonweg 44b 6712 GD EDE The Netherlands T +31 138 693 111 F +31 139 693 042 I www.zxfactory.nl