Hi, I am trying to log messages from many servers of the network, each to their own file. The messages are coming in via a program called Lasso, which polls windows servers and sends the messages to syslog-ng via TCP. Lasso turns out to look like a "relay" in syslog-ng parlance. Each message comes from it's source, through the lasso server, and arrives at the syslog-ng server. I have the chain_hostnames(yes) set. Syslog-ng is able to resolve the hostname of the relay server, and shows the hostname instead of the IP address. Good. But the source servers are only being displayed by their IP address in the ${HOST} macro. I am using the ${HOST} macro to create the destination filename. It is not being resolved into a hostname. Does anyone out there use any type of relaying, and do you see that each hop in the relay chain is being resolved from IP Address -> Hostname ?? Thanks, Sam Darwin Thirteen WNET