Hello, It seems that syslog-ng starts external program to pipe logs through only at startup. The documentation says so too and there's nothing about restart. Syslog-ng only writes error message to internal log if program is terminated. Feb 3 15:48:17 loghost syslog-ng[971]: io.c: do_write: write() failed (errno 32), Broken pipe Feb 3 15:48:17 loghost syslog-ng[971]: pkt_buffer::do_flush(): Error flushing data But, in some cases it's desirable to watch for this external filter program and restart it when nesessary. Program may die suddenly or may need full restart for reconfiguration. I know that syslog-ng restarts external filter on SIGHUP, and sure i could write watcher script for automatic SIGHUPing of syslog-ng, but automatic filter program restart, perhaps with some frequency limitations would be quite useful. Is there any considerations against that? -- Dmitry Frolov, Zenon N.S.P. (095) 250-4629, http://www.zenon.net/