Hello, I am running syslog-ng (1.4.17) on Linux (2.4.21) and received an error when the disk partition became full. Looking at the code, it does not look as though the error was handled very well. After the error, syslog-ng started to take up 26% of my CPU time and was unresponsive to other logged messages to the file that was being written to when the error occurred (even though the room was made in the partition). The specifics are: Received this error - Jun 25 13:16:57 port1-1 syslog-ng[147]: io.c: do_write: write() failed (errno 28), No space left on device So, do_write() correctly identifies the error and puts out a nice message that the disk is full. int res = write(self->fd, data, length); if(res < 0) { switch(errno) { case EINTR: case EWOULDBLOCK: return 0; default: werror( "io.c: do_write: write() failed (errno %i), %z\n"); } ... return(res); } The only place I can see where do_write is called is write_callback() where I would have liked to have seen a "if(w < -1) do_something" but the value of w is just sent in as an argument to BUF_FLUSH(). static void write_callback(struct nonblocking_fd *fd) { CAST(io_fd, self, fd); int res; struct fd_write w = {{ STACK_HEADER, do_write), fd->fd, self->fsync }; assert(self->buffer); res = BUF_FLUSH(self->buffer, &w.super); So, if w is an error (-1), what is &w.super equal to? Something not good. Maybe I have this wrong. Maybe there is another place where do_write() is called. Regardless, the value of w is not being checked so what is the proper course of action if w is -1? Note: my syslog-ng is running on an embedded system that does not have much flash memory to store these logs. The system has a process that truncates the log files when they exceed specific limits, but the granularity of the file size checking can mean that one or more processes can exceed their limit(s) and cause the disk to be full before the checker process wakes up and does the cleanup, as happened in this case. Thanks. John Feeney -------------------------------------------------------- This email message and any files transmitted with it contain confidential information intended only for the person(s) to whom this email message is addressed. If you have received this email message in error, please notify the sender immediately by telephone or email and destroy the original message without making a copy. Thank you.