We run syslog-ng (both 1.x and now 2.0.9) on FreeBSD writing log files to a NetApp NFS server. At a very low load we start dropping inbound packets (udp, large socket buffers). A quick tcpdump showed a pathological interaction with NFS revolving around how NFS (at least on BSD) deals with APPEND mode. The upshot is that for each write, it flushes the attributes and actually re-reads the partial file block back from the server! A simple change to the source to remove O_APPEND had great results we can handle 10x the number of inbound messages. Our .conf file has every logging host going to a separate file, and with a quick scan of the code it sure looked like syslog-ng won¹t open the same file more than once anyway (I could be wrong here). So, a couple questions (I scanned the last few months of archives but didn¹t see any discussion about this) - what breaks if anything by turning off APPEND, is this interesting to others/how might I get this into future releases ( I can see this being a per-destination option). thanks. -- It is the mark of an instructed mind to rest satisfied with the degree of precision which the nature of a subject admits, and not to seek exactness when only an approximation of the truth is possible. Aristotle