Then you have two major problems: 1. why is all the date prior to 'disk full' getting lost
Sorry, i meant that logs that are lost because of disk full are not important. The logs up to the disk full are important, and also logs after disk is free are important. But I must not restart syslog-ng. so it goes like this boot linux, syslog-ng online, ... logging -> disk full ... not logging -> disk free ... logging again (does not matter if in same file than before disk was full or not whatever's easier :) ). syslog-ng must run all the time. cheers! Andrej _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/