I'm trying to tune syslog-ng 3.3.3. My first attempt is to use the log_fetch_limit parameter, but I'm running into the problem of where to define it! The Admin guide says I can put it in the global options{}, but that generates and error saying it has been taken out of the global area and needs to be specified by the source and I can't seem to find the correct source syntax. My config (pared down): @version: 3.3 @include "scl.conf" options { # log_fetch_limit(100); }; source s_local { system(); internal(); }; ############################################################################# # Service all filter f_all_pgm_01{program("*" type("glob"));}; filter f_all_lvl_01.01{level(info..emerg)}; destination d_all_01{file("/var/log/system.log" suppress(30));}; log { source(s_local); filter(f_all_pgm_01); filter(f_all_lvl_01.01); destination(d_all_01); }; I've tried putting it in: source s_local{ system( log_fetch_limit(100); ); ...}; source s_local{ system(); ... log_fetch_limit(100); }; log{ source(s_local log_fetch_limit(100);); ... }; each generate a 'syslog-ng[1567]: Error parsing configuration;' error. Any ideas on *where* I should put it? Thanks, Chris ---------------------------------------- Christopher Johnson chris.johnson3@hp.com<mailto:chris.johnson3@hp.com> HP Software - Security Product Group (916) 785-2817 ----------------------------------------