Hi, I discovered a problem in syslog-ng-2.0.6. In my Gentoo installation there were some default program destinations configured: destination mail-alert { program("/usr/local/bin/syslog-mail"); }; destination mail-alert-perl { program("/usr/local/bin/syslog-mail-perl"); }; But these programs do not exist in my installation. strace shows that syslog-ng is looping while trying to start these processes: --- SIGCHLD (Child exited) @ 0 (0) --- sigreturn() = ? (mask now []) close(6) = 0 fcntl64(13, F_GETFL) = 0x1 (flags O_WRONLY) fcntl64(13, F_SETFL, O_WRONLY|O_NONBLOCK) = 0 waitpid(-1, [{WIFEXITED(s) && WEXITSTATUS(s) == 127}], WNOHANG) = 19922 close(7) = 0 pipe([6, 7]) = 0 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0xb7ca2708) = 19927 --- SIGCHLD (Child exited) @ 0 (0) --- sigreturn() = ? (mask now []) close(6) = 0 fcntl64(7, F_GETFL) = 0x1 (flags O_WRONLY) fcntl64(7, F_SETFL, O_WRONLY|O_NONBLOCK) = 0 waitpid(-1, [{WIFEXITED(s) && WEXITSTATUS(s) == 127}], WNOHANG) = 19924 close(8) = 0 pipe([6, 8]) = 0 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0xb7ca2708) = 19928 --- SIGCHLD (Child exited) @ 0 (0) --- sigreturn() = ? (mask now []) close(6) = 0 fcntl64(8, F_GETFL) = 0x1 (flags O_WRONLY) fcntl64(8, F_SETFL, O_WRONLY|O_NONBLOCK) = 0 waitpid(-1, [{WIFEXITED(s) && WEXITSTATUS(s) == 127}], WNOHANG) = 19926 close(13) = 0 pipe([6, 13]) = 0 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0xb7ca2708) = 19929 Sending it a HUP makes the situation even worse (I think it just starts another loop) and syslog-ng consumes considerable CPU time after that. syslog-ng ought to check if the file exists before trying clone(). Maybe also a warning would help to spot the config problem (there is none, even with the -d flag). But like this it is really hard to find the problem. Cheers Ortwin Glück