I'm running a syslog-ng process which is receiving messages from Solaris 6, 7, and 8 machines generated by the native Solaris syslogd, some of which originate from routers and other networking infrastructure. Occasionally I get radically malformed messages, which syslog-ng places in the wrong locations. The file destination writes these messages to $HOST/$PRIORITY, etc., but these varibales consist of this munged data. Unfortunately, this forces me to manually clean out and remove the directory structure the messages created. Any ideas on how to prevent this from happening in the first place? I'm also concerned that a maliciously formed syslog packet could cause syslog-ng to inadvertedly overwrite system files. For example, if the file destination was: /var/log/$HOST/$PROCESS And the expansion was: $HOST = "../../etc" $PROCESS = "passwd"; This system file could be overwritten. Any comments or information on internal syslog-ng checks to reassure me from worrying about this? Thanks, Keith Resar. --