Well shoot...here's what I got...I'm using the stock syslog-ng.conf installed with 3.5.4.1 just for testing: ############################################################################# # Default syslog-ng.conf file which collects all local logs into a # single file called /var/log/messages. # @version: 3.3 @include "scl.conf" source s_local { system(); internal(); }; source s_network { udp(); }; destination d_local { file("/var/log/messages"); }; log { source(s_local); # uncomment this line to open port 514 to receive messages #source(s_network); destination(d_local); }; Running strace here's the last bit: /usr/sbin/syslog-ng -t -d -v -F -f /usr/etc/syslog-ng.conf open("/usr/lib/libsyslog-ng-3.3.11.so", O_RDONLY) = 10 read(10, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0@0\1\000"..., 512) = 512 fstat64(10, {st_mode=S_IFREG|0755, st_size=1427313, ...}) = 0 mmap2(NULL, 447784, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 10, 0) = 0xb79d7000 mmap2(0xb7a40000, 16384, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 10, 0x68) = 0xb7a40000 mmap2(0xb7a44000, 1320, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xb7a44000 close(10) = 0 write(2, "iv_tls_user_register: called aft"..., 43iv_tls_user_register: called after iv_init ) = 43 rt_sigprocmask(SIG_UNBLOCK, [ABRT], NULL, 8) = 0 tgkill(5172, 5172, SIGABRT) = 0 --- SIGABRT (Aborted) @ 0 (0) --- +++ killed by SIGABRT +++ Process 5172 detached And that's it....I'm glad I'm doing this on a virtual machine. I've not been able to anything on this online...thoughts or help are appreciated. James