Hi there, On Sat, 22 Dec 2007 Ivey, Chris wrote:

... it appears as though syslog-ng is pulling the milliseconds from the alert (the .839 in the second example) and moving it to the 4th token spot, instead of leaving it attached. Anyone seen this behavior, and more importantly, what do we need to do to fix it? I am on syslog-ng version 1.6.11.

I wouldn't normally have answered this since I can't comment on the behaviour of 1.6.11 but it is possible that you won't get much other response over the holiday period. Your syslog-ng is rather old - I'm using syslog-ng 2.0.6 - so I guess the first thing for you to do is to try that too. Compliments of the season to all! -- 73, Ged.