Updated to 1.3.17 and create_dirs() works great. I have ran into a problem with the $PROGRAM macro coming from remote hosts. Here is a snippet of my conf destination d_facility { file("/var/log/syslog-ng/$HOST/$YEAR/$MONTH/$DAY/$FACILITY" perm(0600)); }; destination d_program { file("/var/log/syslog-ng/$HOST/$YEAR/$MONTH/$DAY/$PROGRAM" perm(0600)); }; options { sync(0); use_dns(yes); create_dirs(yes); }; log { source("src"); destination("d_facility"); }; log { source("src"); destination("d_program"); }; The $PROGRAM expands as i would expect when recieving messages from the localhost, but when syslog-ng receives remote messages, $PROGRAM gets expanded to a file name (NULL) under the appropriate directory. however remote messages get expanded correctly with the $FACILITY macro. Did i miss something here? Chris Scheller System/Network Administration Network One Internet, inc. http://www.networkone.net/ 1.888.GOT-NET1