Actually, I'm testing a linux box under almost exactly that configuration, and (going to check) after about 24 hours running under stress-test conditions (bout 2-4 messages a second from local, about 5-10 messages a second from other machines (UDP)), I've got the following:
VSZ RSS TTY STAT START TIME COMMAND 1596 652 ? S Oct04 0:35 syslog-ng
I haven't actually had any trouble with syslog-ng on Linux since around 1.4.5 or so... Anyhoo, YMMV I suppose.
Wow, I was crashing constantly (like, every half hour) without the assertion fix :)
Try accepting from other machines via TCP, that seems to invoke the strange behavior better.
I never could get TCP syslogging to work at all close to right with syslog-ng. Of course I didn't try all _THAT_ hard to get it going, and it was a few versions back when I tried... And I don't really want to invoke any more strange behavior than I've alreday got truth be told. :)
I'm also using chain_hostnames which might have something to do with it...more string ops.
Actually, I wouldn't think that's it, since I'm using that too. The config from my test box is below: long_hostnames(off); sync(0); time_reopen(10); log_fifo_size(1000); create_dirs(on); use_fqdn(yes); use_dns(no); chain_hostnames(yes); That, on a fairly severely modified ImmunixOS 6.2 base with full errata patches in place, a PIII 500 w/ a lot of RAM, and I got 0 problems. Going to start rotating it into heavier production use before too long, so I might see some more "bad things" when the load goes up, but so far, it's lookin' good. :)
Here's my ng process:
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND root 18717 27.4 4.3 6268 5572 ? R Oct04 642:10 syslog-ng
on 333Mhz PII. The VM use seems steady though...we'll see tomorrow.
Good luck! -- A.L.Lambert