I have the exact same issue with syslog-ng. I run Red Hat 7.3. Despite the claims that the syslog message can be forwarded without being modified, syslog-ng STILL modifies it. The modified syslog message has the original IP address AND the server's IP address in chain format, which is no good. I want to keep the message UNtouched when it gets forwarded. If anyone has the answer to this question I would very much appreciate it. The MAIN reason why I installed syslog-ng was due to the claim that it could forward without changing the message, but so far it just looks like a claim. pj ====================================== Paul Jasa Network Engineer ====================================== -----Original Message----- From: Harrie.van.Arragon@steinmuehlen-brot.de [mailto:Harrie.van.Arragon@steinmuehlen-brot.de] Sent: Tuesday, August 19, 2003 05:17 AM To: syslog-ng@lists.balabit.hu Subject: [syslog-ng]Forwarding unchanged Syslog messages Is it possible to forward syslogmessages without modifing the Host and the messages. I thought "keep_hostname(yes)" would solve the problem, but it didn't. Normaly i use version 1.5.15 shipped with debian, but I tryed 1.5.26 too. I don't konw if its important, but our syslogserver has a load of 100% the whole day (not from syslog-ng). I tryed the following config: options { use_fqdn(yes); sync(0); use_dns(yes); chain_hostnames(yes); keep_hostname(yes); }; source net { tcp(); udp();}; destination pc1 { udp(192.168.1.1);}; destination pc2 { udp(192.168.1.2);}; destination pc3 { udp(192.168.1.3);}; log { source(net); destination(pc1);}; log { source(net); destination(pc2);}; log { source(net); destination(pc3);}; bye Harrie _______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html