> I checked your elogd.cfg: The flag is called "Expand default" not "Expand" as 
> you had it. With "Expand default = 0" it works fine. Just RTFM...

i could probably recite the manual from memory :/ i wouldn't ask if i wasn't confused about something.

i thought the 'default' word was explaining what the default was for the 'expand' flag, not an actual part of the flag.