I have a rather straightforward syslog-ng.conf. I write all messages from the local host to /var/adm/messages and things that come from the net to a separate (customer specific file) filtered on the source host. All works well except that I can't rotate the customer specific logfiles. I can rotate /var/adm/messages. doing: # mv /var/adm/messages /var/adm/messages.0 # kill -HUP `cat /etc/syslog-ng/syslog-ng.pid` and new log are written to /var/adm/messages BUT: # mv /data/customer-logs/491 /data/customer-logs/491.0 # kill -HUP `cat /etc/syslog-ng/syslog-ng.pid` and new messages are still written to data/customer-logs/491.0 I also tried stopping and starting syslog-ng and moving the file somewhere completly different. It still magically remembers the old file. Any idea ?? Relevant part of my config: source local { sun-streams("/dev/log" door("/etc/.syslog_door")); internal(); }; destination syslogfile { file("/var/adm/messages"); }; log { source(local); destination(syslogfile); }; source net { udp(); }; filter filter491 { host("12.34.56.78");}; destination logfile491 { file("/data/customer-logs/log491" perm(0644)); }; log { source(net); filter(filter491); destination(logfile491); }; (I'm using syslog-ng-1.4.14 on SunOS 5.8 sparc) Thanks, -- Wim Livens. IP Security Engineer. C o l t B e l g i u m