snip from: "man 2 read":
When attempting to read from an empty pipe or FIFO:
+ If no process has the pipe open for writing, read() will return 0 to indicate end-of-file.
+ If some process has the pipe open for writing and O_NONBLOCK is set, read() will return -1 and set errnoto EAGAIN.
+ If some process has the pipe open for writing and O_NONBLOCK is clear, read() will block until some data is written or the pipe is closed by all processes that had the pipe open for writing.
syslog-ng will open /dev/log - try to read from /dev/log and will recive end-of-file. syslog-ng closes /dev/log and open the file again - try to read from /dev/log and recieve end-of-file - etc. etc.
thanks for the explanation. What does poll() return on pipes with no writer processes? If syslog-ng maxes out the CPU it most probably means that poll() returns that the pipe is readable. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt