[syslog-ng]how to make program destination

I am fairly new to central logging with syslog-ng and had a couple questions. I tried briefly looking to the mailing list archives, but I couldn't find any way to easily search it. I want to have some matched log entries from various hosts sent to the network admin staff. What would be most preferential is to have the source hostname in the subject line and the log message as the body. I defined the following: destination d_mail { program("mail -s \"Matched log entry from $HOST\" syslog); }; With this I DO get an email, but the $HOST macro is empty and the message body is also empty. Is there a better method? Or can anyone help with an example or two? Thanks, David Monk CCNA, MCSE david@purplebear.net