I tried that order and it didn't work. I guess I left out some important information before. This is on solaris8, accepting traffic inbound over udp from stock solaris syslogd entries, I don't know if that hoses things up or not. Also I'm running syslog-ng-1.6.0rc3+20030429. In fact, I think the DNS piece is completely hosed, because when I tell it to use dns I start getting $HOST variables set to IP addresses. The only way I can get the shortname back is to turn off all the functions to try and get the hostname and just keep the name sent over with the syslog message. I've tested this from another system running syslog-ng-1.6.0rc3+20030429 sending via UDP and it has the same symptoms, though it at least gets the short name. -----Original Message----- From: Nate Campi [mailto:nate@campin.net] Sent: Wednesday, April 30, 2003 3:05 PM To: syslog-ng@lists.balabit.hu Subject: Re: [syslog-ng]FQDN in the destination On Wed, Apr 30, 2003 at 02:24:32PM -0700, Glasser, Rob wrote:

I'm trying to use the fully qualified domain name in my directory naming structure in a destination function. Here is what I have:

I do this: use_fqdn(yes); keep_hostname(yes); use_dns(yes); long_hostnames(off); then.. destination hosts { file( "/var/log/HOSTS/$HOST/$FACILITY/$YEAR/$MONTH/$DAY/$FACILITY$YEAR$MONTH$D AY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes) template("$DATE $FULLHOST $MESSAGE [$FACILITY.$LEVEL]\n") template_escape(no) ); }; log { source(src); destination(hosts); }; Works for me with 1.5.26 on debian woody. -- Nate Campi http://www.campin.net _______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html