The documentation defines the macro WEEK_ABBREV, C_WEEK_ABBREV, R_WEEK_ABBREV, S_WEEK_ABBREV Description: The 3-letter English abbreviation of the name of the day the message was sent, for example Thu. but syslog-ng (3.9) actually populates the macros WEEK_DAY_ABBREV, C_WEEK_DAY_ABBREV, R_WEEK_DAY_ABBREV, S_WEEK_DAY_ABBREV -- Evan