Just as I'm leaving, I noticed this on my loghost at work (redhat 6.2, UDP logging for around 50 hosts): Sep 5 18:13:04 loghost syslog-ng[24136]: syslog-ng version 1.4.4 starting Sep 5 18:13:04 loghost syslog: syslog-ng startup succeeded Sep 5 18:13:04 loghost syslog: klogd startup succeeded Sep 5 18:13:06 loghost syslog-ng[24136]: io.c: do_write: write() failed (errno 27), File too large Obviously I need to rotate the logs more often on that host, but were you aware that there is a limit to the file sizes syslog-ng could write to? # ls -al /var/log/messages -rw----r-- 1 root root 9048923 Sep 5 18:15 messages Ok, that's a huge logfile, but I just wanted to post that here in case it's relevant. -- Nate Campi "If we knew what we were doing, it wouldn't be called research." - Einstein