I am still having the problem where remote messages to syslog-ng 1.6.0rc1 are labeled with the receiving host's name instead of the IP/hostname of the sending host. I have keep_hostname set to yes and use_dns set to no. I turned on Sun's syslogd to compare some things and noticed that entries that Sun's syslog cannot resolve are labeled with the IP address (10.10.5.13) and 2 additional 'octets' in brackets like this: Apr 9 14:28:34 [10.10.5.13.224.124] venue1258 PPTP-1 down: Remote clearing Is this related to the problem I am seeing with 1.6.0rc1? Is the sun streams device sending it an address it can't interpret? I figure one of those octets is the source port, but I don't know what the last one is... Brian