...

Is this possible to do in syslog-ng? Or is there any other method of getting the values from the $MSG variable?

I could of course read it from the pipe with some awk or perl script and build the sql-syntax from there. But since I will have quite a few different table formats it would then need a perl interpreter running for each table. Not very pretty IMO.

something similar is available in 1.9.x but that is still not ready for production environments.

the syntax is to use $1 .. $9 in place of $MSG[13]

Excellent! We will be waiting anxiously for this. In fact... If you want a server or two to test, I think I could swing that. I have at least one machine here that runs named (hence gets a fair number of log messages) that is just a test box if you want to try it out. RedHat 7.3 (fully patched). --J