hostA 192.168.100.1-+ | hostB | 192.160.100.3-+--> local logger <---> firewall <--> VPN <--> central logger | 192.168.100.100 <public IP> hostC | 192.168.100.3-+ I'm trying to setup a centralized syslog server for several geographically diverse locations. The hostA, hostB, hostC computers all log to local logger (192.168.100.100). And this server logs to the central logger. I'm a little confused on what settings I need: long_hostnames or chain_hostnames? Looking at the web, it seems like they are aliases for the same functionality. keep_hostname(no), because I want hostA/local logger in the log files collected at the central logger? Others, I played with, but I cannot get the combo to work right. use_dns(yes)? use_fqdn(yes)? If I was the logs in central logger to look like hostA/local logger, which commands so I turn on? If I get this to work, I'll add it to the sample configs. -- Bob Tanner <tanner@real-time.com> | Phone : (952)943-8700 http://www.mn-linux.org | Fax : (952)943-8500 Key fingerprint = 6C E9 51 4F D5 3E 4C 66 62 A9 10 E5 35 85 39 D9