I've sucessfully beaten down the memory leak issues I've been experiencing thanks to Balazs suggested patches. I am now experiencing a different sort of "leak". I worked back from the log files to identify the problem, but not the cause. I restart syslog-ng weekly. Towards the end of each week, I notice log messages: syslog-ng[15710]: STATS: dropped 12828 syslog-ng[15710]: Error initializing raw socket, spoof- source support disabled. (libnet_open_raw: SOCK_RAW allocation failed: Too many open files) syslog-ng[15710]: Error initializing raw socket, spoof- source support disabled. (libnet_open_raw: SOCK_RAW allocation failed: Too many open files) syslog-ng[15710]: Error initializing raw socket, spoof- source support disabled. (libnet_open_raw: SOCK_RAW allocation failed: Too many open files) A quick "lsof -c syslog-ng" revealed a few hundred open files. I restarted syslog-ng and checked for open files - the number was about 25. In the past hour of monitoring, that number has jumped to over 70. The "files" that appear to be increasing are these (from the output of lsof) : syslog-ng 17081 root 61u raw 51703353 00000000:00FF->00000000:0000 st=07 syslog-ng 17081 root 62u raw 51711769 00000000:00FF->00000000:0000 st=07 syslog-ng 17081 root 63u raw 51721047 00000000:00FF->00000000:0000 st=07 syslog-ng 17081 root 64u raw 51727149 00000000:00FF->00000000:0000 st=07 syslog-ng 17081 root 65u raw 51738764 00000000:00FF->00000000:0000 st=07 My syslog-ng.conf specifies only 4 real log file to write to, and one pipe(for mysql writing), and two UDP destinations (spoof enabled). CPU utilization on the machine is less than 5%, and there's plenty of free memory. Any thoughts? I'd hate to have to restart syslog-ng daily.