Could keep_hostname() be implemented as an option usable locally to source drivers tcp and udp instead of just being a global option? The following example will illustrate what I'm getting at. The following excerted configs are used on the syslog-ng servers: options{ keep_hostname(no); use_dns(no); chain_hostname(no); }; source syslog { udp( port(514) ); }; source syslog-ng { tcp( port(514) ); }; When host A sends syslog message to syslog-ng server B, the message is written with the host A IP address. Then, syslog-ng server B relays this message to a central syslog-ng server C, the message is written with the syslog-ng server B IP address. It would be useful to write the message at the central server with the host A IP address as that is the IP address that originated the message. I could change the global option on the central syslog-ng server to be keep_hostname(yes) and the message will be written with host A IP address. However, that means that messages that are not being relayed (e.g. sent directly from a syslog host to the central syslog-ng server C) will have the keep_hostname(yes) applied when the desired option is keep_hostname(no) for those messages. The following example config shows the extension of keep_hostname() use that I'm suggesting. options{ use_dns(no); chain_hostname(no); }; source syslog { udp( port(514); keep_hostname(no); ); }; source syslog-ng { tcp( port(514); keep_hostname(yes); ); }; Possibly a patch Balazs? :-) A side note, with keep_hostname(no) and use_dns(no) the syslog-ng internally generated messages are written with the hostname. Possibly make it (or optionable) that when keep_hostname is no, those internal messages are written with the host IP address? Keeps the written log structures consistent especially when using macro expansions. Nam __________________________________________________________ Get your FREE personalized e-mail at http://www.canada.com