just to check - do you mean the events are coming through to syslog with wrong timezone - or do you mean the syslog server is showing the wrong timzene in its events - both are unique/seperate alan