I haven't seen this one before. Running syslog-ng 1.5.13 on Solaris 8 64bit. It only handles logs locally for that one machine (config below). The problem: when the logfiles rolled over to May, I ended up with two logfiles for May 1: a "maillog-05-01-2001" and "maillog-05-01-2002". I know the file isn't simply leftover from last year, because this box didn't exist last year. :) Oddly enough, it seems that the 2001 file was used for May 1 up until 3:59am, and at 4:00am the 2002 file picks up where it left off. The machine has no crontabs that run at 4am (or 3am for that matter). No one logged in and did anything. Any ideas at all? Thanks in advance... syslog-ng.conf: --------------- options { long_hostnames(off); keep_hostname(yes); use_dns(no); }; source src { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; destination mail { file("/var/log/maillog-$MONTH-$DAY-$YEAR" create_dirs(yes)); }; destination others { file("/var/log/messages-$YEAR-$MONTH" create_dirs(yes)); }; filter mail { program("postfix") or program("amavis") or program("amavisd"); }; filter others { not program("postfix"); }; log { source(src); filter(mail); destination(mail); }; log { source(src); filter(others); destination(others);};