I'm happy to report that the bug where file sources are not closed before they were reopened is almost fixed. By "almost" I mean that when I send syslog-ng a HUP, this happens: /root: # /etc/rc.d/syslogng reload Reloading syslogng config files. Changing permissions on special file /dev/klog Error opening file /dev/klog for reading (Device busy) Changing permissions on special file /dev/klog However, syslog-ng doesn't core dump as it did previously, and it continues to log kernel messages, so apart from the above error messages, it works. By the way, why is syslog-ng changing the permission on the file source? The default should be to leave it alone. My source statement is very simple: source kernel { file("/dev/klog"); }; What's really odd is that it is changing the permissions to 000. Not too big a deal in this instance, since only root reads /dev/klog anyway, but it would certainly cause havoc in some other cases (like someone reported already regarding /dev/null).