I've been having a problem with the $HOST macro. My setup is as follows: message gets sent from HostA through HostB and finally to the log server HostC. HostA is a Windows box running Snare for Windows, HostB is a FreeBSD box running syslog-ng, and HostC is a FreeBSD box running syslog-ng. HostA doesn't have a config file, it's a GUI app, but here are parts of the syslog-ng config files: HostB Config ------------ # Options options { keep_hostname(yes); long_hostnames(off); sync(0); }; HostC Config ------------ # Options options { keep_hostname(yes); long_hostnames(off); sync(0); }; HostA - moon-a, 10.10.2.2 HostB - moon, 10.10.1.7, 10.10.2.1 HostC - mars, 10.10.1.2 On the log server I have files from HostA go to $HOST.log. It then puts it as 10.10.1.7.log instead of moon-a.log. Also, here is a line from the file where it puts the IP address of HostB and hostname of HostA. Jul 8 10:57:00 10.10.1.7 moon-a MSWinEventLog 1 Application 675 Thu Jul 08 10:56:08 2004 0 sshd SYSTEM User Information MOON-A None sshd : PID 1808 : Server listening on 0.0.0.0 port 22. 1 Let me know what you think the problem is? Phusion __________________________________ Do you Yahoo!? Yahoo! Mail Address AutoComplete - You start. We finish. http://promotions.yahoo.com/new_mail