Hi, System information where this problem has been discovered: OS: AIX 5.3 Syslog NG version: 1.6.9 libol: 0.3.17 aixhost53: <13>Mar 22 10:11:50 src@aixhost53 auth|security:info sshd[454900]: Connection from 192.168.10.20 port 42498 <13>Mar 22 10:11:50 src@aixhost53 auth|security:info sshd[454900]: Failed none for root from 192.168.10.20 port 42498 ssh2 As you can see above, the AIX 5.3 system syslogd appends the facility and priority level to the message. I found no way to stop AIX's syslogd doing this nasty thing. Nevertheless when syslog-ng receives this message it is unable to parse the fields correctly because it reads eg. "auth|security:info" as program name. I've spend a quick look at the code, namely 'macros.c' where it reads "colon = memchr(msg->msg->data, ':', msg->msg->length);" in line 398 macros.c: ... case M_MSGONLY: { char *colon; int ofs; colon = memchr(msg->msg->data, ':', msg->msg->length); if (!colon) { ofs = 0; } else { // origofs = (colon - (char *) msg->msg->data) + 2; ofs = (colon - (char *) msg->msg->data) +6; if (ofs > msg->msg->length) ofs = msg->msg->length; } length = append_string(dest, left, (char *) msg->msg->data + ofs, msg->msg->length - ofs, escape); break; } ... syslog-ng.conf: destination tempfile { file("/tmp/syslog-ng.debug" template("$YEAR-$MONTH-$DAY $HOUR:$MIN:$SEC $HOST $MSGONLY\n") template-esc ape(yes)); }; The syslog-ng.conf destination entry above causes that the message is cut off at "nfo sshd ...." and thus MSGONLY would read 'nfo sshd[454900]: Connection from 192.168.10.20 port 42498' instead of "Connection from 192.168.10.20 port 42498" @Balazs: could you investigate this, if there is a fix possible for this "parsing error" ? thx Jochen