You might get a good idea by using dig @localhost loghost.domain.com If that gives you what you need, then try using tcpdump from one of the failing hosts after a kill -HUP on syslogd. Hope this helps, Len