Hi, Sergei. Here is the plugin code for you to check out. It constists of a single new file, so i send you the link to it. http://myoffice.izhnet.ru/~alex/server_audit/server_audit.c What's missing in it as i'm not sure how it can be done: - No server host/ip in the log. How get that information? - SYSLOG logging. The SysLog i knew was declared in the syslog.h. That's the interface talking to the local syslogd instance. If it's what we need to use, then i have no idea how to specify the Syslog server IP for that daemon (which is required by the spec). I see nothing in the API about it and i thought it should be configured with the daemon's cfg file or something like that. Best regards. HF