Hi Laci, Thanks for your advice. I think that the behavior you described for mark-freq is exactly what I'm trying to accomplish, but it doesn't seem to work. There must be some detail that I'm missing. In my test, I've set mark-freq to 60 seconds for the destination heartbeat.log. When I watch (tail) heartbeat.log, I'm seeing this type of results: Oct 31 08:44:02 192.168.35.1 ...I am still here... Oct 31 08:45:03 syslog -- MARK -- Oct 31 08:45:19 192.168.35.1 ...I am still here... Oct 31 08:46:19 syslog -- MARK – Oct 31 08:46:32 192.168.35.1 ...I am still here... Oct 31 08:46:40 192.168.35.1 ...I am still here... Oct 31 09:43:46 192.168.35.1 ...I am still here... As you can see, the destination is not busy. Shouldn’t a MARK have happened at 08:47:40? The “internal” mark-mode looked a bit complicated, but I’ll read it again. Thanks again, Gregg -----Original Message----- From: syslog-ng <syslog-ng-bounces@lists.balabit.hu> On Behalf Of Laszlo Szemere (lszemere) Sent: Thursday, October 31, 2019 09:30 To: syslog-ng@lists.balabit.hu Subject: Re: [syslog-ng] email alert on timeout Hello Gregg, I think you are almost on the right track. A little addition to MARK messages: Syslog-ng's destinations will ONLY emit a mark message IF otherwise there will be no message at all from that destination, during a "mark-freq" time period. So if there is a message on the Destination, it will reset the "mark-freq" timer, and the interval starts again without sending any mark message. So during a normal work of a busy log path there should be no mark messages at all. One more thing: I don't know if it is intentional from you, but you can spare the whole "mark" file logic from your configuration in certain cases, if you use the "internal" mark-mode. Unfortunately I can not give you a direct link, but in the "global options" section of the administration guide: <https://www.syslog-ng.com/technical-documents/doc/syslog-ng-open-source-edition/3.24/administration-guide/59#TOPIC-1298095> https://www.syslog-ng.com/technical-documents/doc/syslog-ng-open-source-edit... there is a chapter about "mark-mode"s. Best regards, Laci