I'm using syslog-ng as a receiver to relay messages to local processes and other remote syslog listeners. I'm not currently using any local file destinations. The issue I'm having is that as soon as I start receiving more than a few hundred messages per second (udp) syslog-ng uses significant CPU resources, even on an intel core-duo. At 1000 messages per second with an average message size < 300 bytes syslog-ng consumes 9-12% CPU. With an event rate closer to 4000 messages per second the CPU use is 35-30%. This seems excessive given that I'm doing no filtering at all. In a test configuration, I am only receiving (no log{} clauses at all) and this behaviour is still demonstrated. It seems that all the CPU use is related to incoming packet processing. The test system is Linux 2.6.20 (Ubuntu) running on a Core2 dual 2.16GHz. Once I have completed some profiling I will share the findings but in the meantime: am I missing something that should be obvious? Some searching through the mailing list archives hasn't helped me much. My test configuration file: options { time_reopen(10); chain_hostnames(yes); keep_hostname(no); log_fifo_size(65535); gc_idle_threshold(100); gc_busy_threshold(65535); use_dns(no); }; source remote_sources { udp(ip(0.0.0.0) port(514)); }; destination event_collector { tcp("127.0.0.1" port(1028)); }; # log { # source(remote_sources); # destination(event_collector); # }; Thanks, Rory