Hi, When a connection broken is detected (error when writing a line to an invalid socket), the line that make the "connection broken" to be detected is definitly lost. In a local file Feb 24 22:09:47 src@loki root: 10 11 12 13 14 15 16 17 18 19 20 21 22 23 Feb 24 22:09:48 src@loki root: 10 11 12 13 14 15 16 17 18 19 20 21 22 23 Feb 24 22:09:48 src@loki syslog-ng[18900]: Connection broken to AF_INET(127.0.0.1:40000), reopening in 60 seconds Feb 24 22:09:49 src@loki root: 10 11 12 13 14 15 16 17 18 19 20 21 22 23 In the remote process # nc -l -p 40000 (...) Feb 24 22:09:47 src@loki root: 10 11 12 13 14 15 16 17 18 19 20 21 22 23 <Ctrl-C> # nc -l -p 40000 <43>Feb 24 22:09:48 src@loki syslog-ng[18900]: Connection broken to AF_INET(127.0.0.1:40000), reopening in 60 seconds <13>Feb 24 22:09:49 src@loki root: 10 11 12 13 14 15 16 17 18 19 20 21 22 23 le log line at Feb 24 22:09:48 is definitly lost, is it normal? B DOLEZ -- Benoit DOLEZ, EXOSEC (http://www.exosec.fr/) 12 av des Pres - BL233, 78059 St Quentin en Yvelines cedex Tel: +33 1 61 37 05 35 - Fax: +33 1 61 38 10 65 GSM: +33 6 21 05 91 69 - mailto:bdolez@exosec.fr