Great stuff, many thanks Balazs. =-) -cheers, CSB Balazs Scheidler wrote: > Yes, keep_timestamp(no) should be a good solution if you really want to use the syslog server's timestamp, instead of the one in the message. <snip>