Hi again, during yesterdays problem my postfix statistics reporting tool (pflogstats) reported about incomplete logging in 4 cases. In all 4 cases I have syslog-ng restarted before. Example: Feb 12 22:22:54 syslog-ng[1871]: syslog-ng version 1.5.26 going down Feb 12 22:22:54 syslog-ng[5317]: syslog-ng version 1.5.26 starting Feb 12 22:22:54 syslog-ng: syslog-ng startup succeeded Feb 12 22:23:01 crond: crond shutdown succeeded <- already learnt :-( Feb 12 22:23:02 crond: crond startup succeeded Missing nqmgr: Feb 12 22:29:58 (7 minutes later, first received e-mail after syslog-ng restart) postfix/smtpd[5507]: C12F31386E: client=outgoing3... postfix/cleanup[5521]: C12F31386E: message-id=<20030212180349.... postfix/smtpd[5507]: disconnect from outgoing3... postfix/pipe[5525]: C12F31386E: to=<pbieringer@... Normally (e.g. next delivered e-mail): Feb 12 22:29:59 postfix/cleanup[5521]: 3AEAD1386F: message-id=<20030212180... postfix/pipe[5525]: C12F31386E: to=<pbieringer@aer... postfix/nqmgr[19977]: 3AEAD1386F: from=<bugtraq-r.... <--!!!!! postfix/smtp[5530]: 3AEAD1386F: to=<pbieringer@aerasec.de>,... Where is the nqmgr log line lost in first event? Is this a well-known issue (feature or bug)? If yes, how can this be fixed? Pls. don't tell me that I have to restart every service after I restart syslog-ng (already known: crond, now postfix, which one is still missing?). This would be a very unnice "feature". If bug is in a common used glibc-version, then imho a workaround by syslog-ng would be required. I don't like to loose loglines, you sure not, too. Does this also happen if old syslogd would be used? Don't believe so. It's all very strange...looks like I have to switch back to syslog, loosing all the nice features :-( Peter, wondering -- Dr. Peter Bieringer http://www.bieringer.de/pb/ GPG/PGP Key 0x958F422D mailto: pb at bieringer dot de Deep Space 6 Co-Founder and Core Member http://www.deepspace6.net/