The keep_hostname is a server option really. If you are receiving messages on that host than keep_hostname is what you are looking for. The server on the other end of your connection,ie 192.168.1.1 needs to be syslog-ng and have its keep_hostname option set to on. Turn chain_hostnames off as all this does is put each hostname that it has passed through on the hostname chain. You probably don't want that. Regards, Drew -----Original Message----- From: Harrie van Arragon [mailto:harrieva@web.de] Sent: Tuesday, August 19, 2003 9:19 AM To: syslog-ng@lists.balabit.hu Subject: [syslog-ng]Forwarding unchanged Syslog messages Is it possible to forward syslogmessages without modifing the Host and the messages. I thought "keep_hostname(yes)" would solve the problem, but it didn't. Normaly i use version 1.5.15 shipped with debian, but I tryed 1.5.26 too. I don't konw if its important, but our syslogserver has a load of 100% the whole day (not from syslog-ng). I tryed the following config: options { use_fqdn(yes); sync(0); use_dns(yes); chain_hostnames(yes); keep_hostname(yes); }; source net { tcp(); udp();}; destination pc1 { udp(192.168.1.1);}; destination pc2 { udp(192.168.1.2);}; destination pc3 { udp(192.168.1.3);}; log { source(net); destination(pc1);}; log { source(net); destination(pc2);}; log { source(net); destination(pc3);}; bye Harrie __________________________________________________________________________ Die sicherste Form der Kommunikation: E-Mails verschluesseln, Spam-Filter, Adressverifizierung, digitale Unterschrift: http://freemail.web.de _______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html