the problem with this is that bufferring happens at a later stage, after the message is already formatted. Maybe you could achieve the same by putting the received timestamp at the receiving syslog-ng.

No, that's just what I need, to know when originally was recieved from the router, before it's buffered. So the $S_DATE and $R_DATE macros are the solution I was looking for, thank you very much.

-- Bazsi

_______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html