What os are you running, and what command are you using to generate that output (ps with what args)?
Syslog-ng 3+ will fork itself off and the child becomes the real worker process while the parent is a monitor process so that if the child dies it can restart it. At least thats what its supposed to do. I've never had it work, but it doesnt crash so I dont care.

Sent: Tuesday, August 03, 2010 3:47:53 PM
From: Manson, John <John.Manson@mail.house.gov>
To: 'syslog-ng@lists.balabit.hu' <syslog-ng@lists.balabit.hu>
Subject: [syslog-ng] 2 syslogng processes for the price of 1

Good Day,

I start syslog-ng, ver3.0.4, from /usr/local/sbin using the same script I run with older versions of ng on other servers but this is the first time I have seem 2 processes started.

Ng is loading the correct conf file at /usr/local/etc/syslog-ng.conf and is writing log messages to the correct log files, no duplicate entries.

Always 2 pids in sequence.

If I kill the smaller pid, 3532 in this case, the ppid of 1 takes over for 3532 and ng, 3533, runs along just fine.

Help?

Thanks

root 3532 1 0 15:09:54 pts/2 0:00 /usr/local/sbin/syslog-ng -p /usr/local/etc/syslog-ng/syslog-ng.pid

root 3533 3532 0 15:09:54 ? 0:00 /usr/local/sbin/syslog-ng -p /usr/local/etc/syslog-ng/syslog-ng.pid

John Manson

CAO/HIR/NI/Data-Communications | U.S. House of Representatives | Washington, DC 20515

Desk: 202-226-4244 | Team: 202-225-5552 | john.manson@mail.house.gov
______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.campin.net/syslog-ng/faq.html

  