Yes these are syslog traps as they arrive at my syslog server... they are sent from the MX104 running cgnat. This is good info that I cannot change that embedded utc time stamp on the cgnat syslog trap. Thanks Alex -Aaron