The colon in the second field makes syslog-ng's guess that "data" is the hostname incorrect. The option bad_hostname (or is it bad_hostnames? I'm on a train right now and can't look it up) is used to deal with this. -- Nate Campi