I have a device creating logs like this (%raymsg%) <6>AUG 10 22:18:24 2009 netips-warden2-p [audit] user=[*SMS] src=192.168.11.11 iface=5 access=9 Update State Reset rsyslog 4.2.1 makes the hostname 'AUG' and the syslogtag '10' how bad would it be to check to see if it's a case problem like this when no timestamp is detected? David Lang