Are you absolutly sure it isn't a setting somewhere in /etc? You may set the interval to anything you like on Debian by editing /etc/init.d/sysklogd. This sets it to 60 minutes: SYSLOGD="-m 60" (Then restart the syslog daemon: # /etc/init.d/sysklogd restart ) On Red Hat and derivatives, edit /etc/sysconfig/syslog : SYSLOGD_OPTIONS="-m 60" Must come from somewhere, right? ;-) ________________________________ From: Edward Brookhouse [mailto:ebroo@healthydirections.com] Sent: woensdag 3 augustus 2005 18:56 To: 'Syslog-ng users' and developers' mailing list' Subject: [syslog-ng] FW: Mark from 1.9.4 to 1.9.5 I was mistaken - the - MARK - is back - My only option left is to hack the source and remove the function and the reference to it - Anyone have any other suggestions for getting rid of the Mark ??? Is there a compile time option to turn this off??? Even stranger is that the source declares: cfg.c: self->mark_freq = 1200; /* 20 minutes */ but I am seeing a mark once an hour TIA EB ________________________________ From: Edward Brookhouse [mailto:ebroo@healthydirections.com] Sent: Wednesday, August 03, 2005 9:58 AM To: 'Syslog-ng users' and developers' mailing list' Subject: Mark from 1.9.4 to 1.9.5 Hi all, Using 1.9.4 I experienced the -Mark-being inserted although no mark() option was specified in the config - I just upgraded to the 1.9.5 source and the behavior of mark seems to be back to normal - Just FYI E