syslog-ng-bounces@lists.balabit.hu wrote on 12/07/2011 06:02:57:

> I did, on the other hand, try running strace on syslog-ng and this is
> was I got just before my harddrive would wake up, every time:
> http://pastebin.com/raw.php?i=hFZVurBP
>
> What can you make from this strace output? The same pattern was
> repeated again and again. I guess "/usr/sbin/cr" is the cut-off path
> to crond.

Try an 'lsof -p <syslog-ng pid>' to identify what file descriptors 9, 10 and 11 are; that will tell you what files it is polling (or, judging by the write()s, updating) on each occasion.  It would appear you haven't successfully disabled cron's logging in your syslog-ng configuration.

Regards,

Scott Rochford