Getting closer. The problem goes away when the XML pattern DB is disabled. The problem does not appear if the XML pattern db is used in one log {} per below. Once it is used in two log {} blocks, KABOOM! I'm going to try debugging the other half of this which writes to the persistent store to see if I can sort out what's breaking the write. For what it's worth, the problem shows up in both 32 and 64 bit. Matthew. parser p_mon { db-parser(file("/home/y/conf/syslog-ng/xml/mon-db.xml")); }; # parsed log { source(s_udp); source(s_tcp); filter(f_mon_useless); parser(p_mon); filter(f_class_security); rewrite(r_set_format_parsed); rewrite(r_set_type); destination(d_normal); rewrite(r_set_format_welf); rewrite(r_add_welf_raw); destination(d_welf_loghive_sp2); destination(d_welf); }; # unparsed log { source(s_udp); source(s_tcp); filter(f_mon_useless); # XXX: problem disappears when this one is commented out # parser(p_mon); filter(f_class_unknown); rewrite(r_set_format_unparsed); rewrite(r_set_type); destination(d_normal); };