Hi, now it suddenly occurs again (and is gone now, but leaving strange issues): 1) syslog-ng process is stopped - who stops it? # cat /proc/5317/status Name: syslog-ng State: T (stopped) Tgid: 5317 Pid: 5317 PPid: 1 TracerPid: 0 Uid: 0 0 0 0 Gid: 0 0 0 0 FDSize: 32 Groups: 0 1 2 3 4 6 10 VmSize: 1784 kB VmLck: 0 kB VmRSS: 796 kB VmData: 216 kB VmStk: 12 kB VmExe: 76 kB VmLib: 1432 kB SigPnd: 0000000000000000 SigBlk: 0000000000000000 SigIgn: 8000000000001000 SigCgt: 0000000000014001 CapInh: 0000000000000000 CapPrm: 00000000fffffeff CapEff: 00000000fffffeff 2) Logtime is going backwards (note: machine has a well-configured NTP) Feb 12 22:23:02 * crond: crond startup succeeded Feb 12 22:32:54 * syslog-ng[5317]: STATS: dropped 0 Feb 12 23:02:26 * syslog-ng[5317]: STATS: dropped 0 Feb 12 22:57:53 * sshd(pam_unix)[6106]: session opened for user root by (uid=0) Feb 12 22:58:32 * login(pam_unix)[10920]: session opened for user root by LOGIN(uid=0) Feb 12 22:58:32 * root[10920]: DIALUP AT ttyS0 BY root Feb 12 22:58:32 * root[10920]: ROOT LOGIN ON ttyS0 Feb 12 23:01:41 * su: pam_ldap: ldap_result Timed out <- !!! Feb 12 23:01:41 * su(pam_unix)[7874]: session opened for user bin by (uid=0) Feb 12 23:02:11 * su(pam_unix)[7874]: session closed for user bin All very strange. More debug data coming in private e-mail. Peter -- Dr. Peter Bieringer http://www.bieringer.de/pb/ GPG/PGP Key 0x958F422D mailto: pb at bieringer dot de Deep Space 6 Co-Founder and Core Member http://www.deepspace6.net/