Hi, This looks like a problem between your (syslog-ng) client and server: IETF is not processed correctly, so the payload ends up in MESSAGE macro. You need to tell the source() on the destination that it should process RFC-5424 by using flags(syslog-protocol).