How is it possible to have out of order time stamps? My first thought would be that somehow the device itself is sending the timestamp. Do devices have the option of sending a timestamp or not? I would prefer that the syslog daemon itself always write the timestamp if possible to avoid confusion when trying to diagnose multiple device events. Aug 2 15:11:24 ap01.yipes.com KERN: NV:Completed configuration save (secondary) operation Aug 2 15:10:47 t3-0-2-0.jp02.yipes.com mgd[13087]: UI_JUNOSCRIPT_ERROR: junoscript error: syntax error, expecting <command> Aug 2 15:11:26 t3-0-2-0.jp02.yipes.com mgd[13087]: UI_CMDLINE_READ_LINE: user 'auser', command 'start shell ' -MiC Mickey Everts 415.901.2223 direct Unix System Administrator 415.901.2000 main Yipes Communications, Inc. 415.533.1402 cell http://www.yipes.com/ 415.358.4112 fax