I have two logging servers. One is logging data from lots of clients, using syslog-ng 1.6.0rc3 - lets call that Host1. I want to forward the data via tcp/udp to the other host as well - lets call that Host2 using 1.6.2. At the moment, the $HOST field in data logged on Host2 contains Host1, instead of Client1, or Client2, etc. On both Host1 and Host2, I have set :- options { use_fqdn(yes); keep_hostname(yes); }; but the $HOST variable (in the destination variable, and in the message) on Host2 is still being replaced, so I line I know is from Client1, appears to come from Host1. Host1 transfers data to Host2 using :- destination d_netmon { udp("195.215.3.7"); }; log { source(net); destination(d_netmon); }; Am I using the wrong version of syslog-ng ? It seems that many on the list have had this problem before, and used keep_hostname(yes) to fix it. Is this a bug in the latest version ? -- Richard Armstrong