I have tried a series of keep_hostname() and chain_hostnames() settings, but I still won't get it as logrelay/server Either I get it as "logrelay" or as "server". I want this as I want a dir structure like: /var/log/HOSTS/$relay/$server/....... What combination should I have on the: Relay? Final destination (ie: the log server)? Best regards Michael Boman -- Michael Boman Security Architect, SecureCiRT Pte Ltd http://www.securecirt.com