With the sync parameter i can set how many lines are buffered before logs are written to disk, but is it possible to have this buffer flushed after a certain time period? Running with sync(0) eats up too much I/O-performance. I also vaguely remember someone mentioning a way of outputting all the log messages that don't get caught by any filter rules to a file. Anyone know what I'm talking about? It's basically to check that I'm not missing anything important with my current config. Another problem is a bug in Solaris 7 that causes a lot of messages like this to show up in the logs: Nov 9 19:24:08 src@enterprise top[7530]: ypbind client: can't get rdev Nov 9 19:24:37 src@enterprise top[7535]: ypbind client: can't get rdev Nov 9 19:24:42 src@enterprise top[7537]: ypbind client: can't get rdev Nov 9 19:24:46 src@enterprise top[7539]: ypbind client: can't get rdev Nov 10 05:40:00 src@enterprise ypcat[11591]: ypbind client: can't get rdev Nov 10 05:40:00 src@enterprise ypcat[11591]: ypbind client: can't get rdev Nov 10 05:40:01 src@enterprise yppush[11595]: ypbind client: can't get rdev Nov 10 05:40:01 src@enterprise ypxfr[11596]: ypbind client: can't get rdev Nov 10 05:40:01 src@enterprise ypxfr[11596]: ypbind client: can't get rdev Nov 10 05:40:01 src@enterprise ypcat[11605]: ypbind client: can't get rdev Nov 10 05:40:01 src@enterprise ypcat[11605]: ypbind client: can't get rdev Nov 10 05:40:01 src@enterprise yppush[11609]: ypbind client: can't get rdev There's a fix but it requires a reboot and that won't happen for a while on the log server. Is there a way of filtering out these messages? I guess putting and not match("client: can't get rdev") in all the filter rules should work, but I'm looking for a more elegant solution. Thanks, -- ___ . . . . . + . . o _|___|_ + . + . + . . Per Olofsson, konstnär o-o . . . o + MagerValp@cling.gu.se - + + . http://www.cling.gu.se/~cl3polof/