On second read, $MSG's behaviour seems to be dependent upon what version of syslog-ng you're using. According to the documentation, syslog-ng prior to 3.0 had the program name and the pid in $MSG, in 3.0 and past that, $MSG is synonymous to $MSGONLY.
I'm not sure whether <3.0 contains $MSGONLY, but if they do, then all is well, and one can use the same macro for all versions.
Hopefully $MSGONLY is backward compatible with in < 3.0. I'll have to test that. I'll also make a notation in the documentation about this as well. Thanks for the input. -- Champ Clark III | Softwink, Inc | 800-538-9357 x 101 http://www.softwink.com GPG Key ID: 58A2A58F Key fingerprint = 7734 2A1C 007D 581E BDF7 6AD5 0F1F 655F 58A2 A58F If it wasn't for C, we'd be using BASI, PASAL and OBOL.