I keep thinking I'm doing something wrong... I have syslog-ng running on a SUN Ultra 10, and it's been running for 192 days, and I have 700 minutes time and 4.5M size... Of course, I only log from 6 other boxes to it for now. :)
Consider this a success story :) I have used syslog-ng to split up incoming logs per facility and priority, so that if I see a message in the crit file, I can go to the corresponding facility file and see if there were any more message. This functionality has come in very handy a few times. :)
Just for kicks, try HUPping it after you changed the config file to write everything to a file host/program/year.month.day
I bet it starts eating your CPU and RAM until your computer explodes ;)
But we'll see over the next few days...also it HUPs each night when the rotation occurs, so perhaps that does a lot of freeing and we'll get some stable behavior.
Actually, I'm testing a linux box under almost exactly that configuration, and (going to check) after about 24 hours running under stress-test conditions (bout 2-4 messages a second from local, about 5-10 messages a second from other machines (UDP)), I've got the following: VSZ RSS TTY STAT START TIME COMMAND 1596 652 ? S Oct04 0:35 syslog-ng I haven't actually had any trouble with syslog-ng on Linux since around 1.4.5 or so... Anyhoo, YMMV I suppose. -- A.L.Lambert