I've got the following situation: Host A can talk to Host B Host B can talk to Host C Host A can NOT talk to Host C directly Host C is the master logger So I'm trying to set up Host B to act as a forwarder. This "mostly" works: HOST A: destination mylogger { tcp(<HOST B> port(1999) localport(999)); }; filter all { level(info..err); }; log { source(src); filter(all); destination(console_all); destination(mylogger); }; HOST B: source s_tcp { tcp(localip(<HOST B>) port(1999) max-connections(50)); }; destination mylogger { tcp(<HOST C> port(1999) localport(999)); }; filter all { level(info..err); }; log { source(s_tcp); source(src); filter(all); destination(console_all); destination(mylogger); }; HOST C source s_tcp { tcp(localip(<HOST C>) port(1999) max-connections(50)); }; destination logtest { file("/var/log/logtest.log" owner("root") group("adm") perm(0640)); }; filter drop1 { not match ( " session opened|closed for user root|mail") and not match ("STATS: dropped 0"); }; log { source(s_tcp); source(src); filter(drop1); destination(logtest); }; The problem is, HOST B rewrites the message source to itself, so all messages from HOST A arriving at HOST C appear to have "occurred" on HOST B. Is there a way to do real forwarding rather than hacking it as I did above?