Hey folks, I have a user experiencing an issue where some of the incoming logs are not getting piped to my perl script until the second time we generate events. I believe this is generally set using flush_lines(1), but it doesn’t seem to be honoring that setting in the config. I also tried adding flush_timeout(900), but that has no affect. In the output below, if I quit the telnet and start it again, the previously missing events are then received (but the current ones are missing) - basically, it doesn't appear to be flushing every single line. Possible other reason: has something changed between v2.x and 3.x where the program() destination would possibly not send an EOF signal - i.e. is the pipe now kept open vs. an individual call to the program each time in v2.x? To verify that this is happening: Term 1: tail -f /tmp/logzilla_import.txt Term 2: /usr/local/sbin/syslog-ng -f /etc/syslog-ng/syslog-ng.conf -Fdv Term 3: telnet 192.168.254.1 Term 1 results: 192.168.254.1 22 7 3732620769 .Jan 11 2012 19:29:02.284 EST: Telnet2: 1 1 251 1 3751981041 0 2012-01-11 19:29:02 2012-01-11 19:29:02 192.168.254.1 22 7 3732620769 .Jan 11 2012 19:29:02.284 EST: TCP2: Telnet sent WILL ECHO (1) 3751981041 0 2012-01-11 19:29:02 2012-01-11 19:29:02 Term 2 results: Incoming log entry; line='<183>6987: .Jan 11 2012 19:29:02.284 EST: TCP2: Telnet sent WILL ECHO (1)' Incoming log entry; line='<183>6988: .Jan 11 2012 19:29:02.284 EST: Telnet2: 2 2 251 3' Incoming log entry; line='<183>6989: .Jan 11 2012 19:29:02.284 EST: TCP2: Telnet sent WILL SUPPRESS-GA (3)' Incoming log entry; line='<183>6990: .Jan 11 2012 19:29:02.284 EST: Telnet2: 80000 80000 253 24' Incoming log entry; line='<183>6991: .Jan 11 2012 19:29:02.284 EST: TCP2: Telnet sent DO TTY-TYPE (24)' Incoming log entry; line='<183>6992: .Jan 11 2012 19:29:02.284 EST: Telnet2: 10000000 10000000 253 31' Incoming log entry; line='<183>6993: .Jan 11 2012 19:29:02.284 EST: TCP2: Telnet sent DO WINDOW-SIZE (31)' Incoming log entry; line='<183>6994: .Jan 11 2012 19:29:02.284 EST: TCP2: Telnet received DO ENCRYPTION (38)' Incoming log entry; line='<183>6995: .Jan 11 2012 19:29:02.284 EST: TCP2: Telnet sent WONT ENCRYPTION (38) (unimplemented)' Incoming log entry; line='<183>6996: .Jan 11 2012 19:29:02.292 EST: TCP2: Telnet received WILL ENCRYPTION (38)' Incoming log entry; line='<183>6997: .Jan 11 2012 19:29:02.292 EST: TCP2: Telnet sent DONT ENCRYPTION (38) (unimplemented)' Incoming log entry; line='<183>6998: .Jan 11 2012 19:29:02.292 EST: TCP2: Telnet received DO SUPPRESS-GA (3)' Incoming log entry; line='<183>6999: .Jan 11 2012 19:29:02.292 EST: TCP2: Telnet received WILL TTY-TYPE (24)' Incoming log entry; line='<183>7000: .Jan 11 2012 19:29:02.292 EST: Telnet2: Sent SB 24 1 ' Incoming log entry; line='<183>7001: .Jan 11 2012 19:29:02.292 EST: TCP2: Telnet received WILL WINDOW-SIZE (31)' Incoming log entry; line='<183>7002: .Jan 11 2012 19:29:02.292 EST: TCP2: Telnet received WILL TTY-SPEED (32) (refused)' Incoming log entry; line='<183>7003: .Jan 11 2012 19:29:02.292 EST: TCP2: Telnet sent DONT TTY-SPEED (32)' Incoming log entry; line='<183>7004: .Jan 11 2012 19:29:02.292 EST: TCP2: Telnet received WILL LOCAL-FLOW (33) (refused)' Incoming log entry; line='<183>7005: .Jan 11 2012 19:29:02.292 EST: TCP2: Telnet sent DONT LOCAL-FLOW (33)' Incoming log entry; line='<183>7006: .Jan 11 2012 19:29:02.292 EST: TCP2: Telnet received WILL LINEMODE (34)' Incoming log entry; line='<183>7007: .Jan 11 2012 19:29:02.292 EST: TCP2: Telnet sent DONT LINEMODE (34) (unimplemented)' Incoming log entry; line='<183>7008: .Jan 11 2012 19:29:02.292 EST: TCP2: Telnet received WILL NEW-ENVIRON (39)' Incoming log entry; line='<183>7009: .Jan 11 2012 19:29:02.292 EST: TCP2: Telnet sent DONT NEW-ENVIRON (39) (unimplemented)' Incoming log entry; line='<183>7010: .Jan 11 2012 19:29:02.292 EST: TCP2: Telnet received DO STATUS (5)' Incoming log entry; line='<183>7011: .Jan 11 2012 19:29:02.292 EST: TCP2: Telnet sent WONT STATUS (5) (unimplemented)' Incoming log entry; line='<183>7012: .Jan 11 2012 19:29:02.292 EST: TCP2: Telnet received DO ECHO (1)' Incoming log entry; line='<183>7013: .Jan 11 2012 19:29:02.292 EST: Telnet2: recv SB NAWS 132 63' Incoming log entry; line='<183>7014: .Jan 11 2012 19:29:02.292 EST: Telnet2: recv SB 24 0 LINUX' Incoming log entry; line='<183>7015: .Jan 11 2012 19:29:02.493 EST: TCP2: Telnet received WILL ENVIRONMENT (36) (refused)' Incoming log entry; line='<183>7016: .Jan 11 2012 19:29:02.493 EST: TCP2: Telnet sent DONT ENVIRONMENT (36)' ______________________________________________________________ Clayton Dukes ______________________________________________________________