After upgrading from RH6.1 and syslog-ng-1.4.2 to RH7.1 and syslog-ng-1.4.11, only the first hit of a series of hits on the firewall is logged. Restarting the daemon will cause the next hit to be logged, but no more than that. Only the logging of firewall hits is effected. After a great deal of trial and error, I traced the problem to a specific destination in the configuration file. I have attached two verions (Linux text and MS.txt) of the config file. To simplify the configuraton for testing, I deleted several other log destinations, filters and actions. The anomaly persisted, even with the simplified configuration. When the lines containing the destination 'whodat' are commented out, logging proceeds as expected. When the comments are aranged to include either one of the lines containing the whodat destination, the logging reverts to what is described in para one. Can anyone tell what is required to fix the problem?