The new feature that restarts a 'program' destination when it exits is pretty dangerous. Whatever caused the program to exit might be persistent, so that every time you start it you exit, causing an infinite loop of forking and execing. I discovered this the first time I tried to use current Syslog-ng, when the specified destination program didn't exist. I think this should be optional behavior. Another idea that would help with this is not to do the restart until you have a message to deliver. That way, you'd have at most one fork per message. In lieu of an option, I am presently running modified Syslog-ng in which I simply remove the log_pipe_init() from afprogram_dd_exit(). Is that sufficient? I also think that, philosophically, Syslog-ng shouldn't be involved in restarting failed programs, because it isn't a problem special to syslog. I think it's better done by a generic monitor/restarter program. For example, I have a program called 'respawn' that spawns a child and restarts it when it dies. It has various parameters to limit how often it's willing to fork. I tell Syslog-ng destination program(respawn logstuff ...). -- Bryan Henderson San Jose, California