Hi there We're running a multi-country network of syslog-ng with centralized logging (via TCP). However, due to the possibility of network failure, I am not willing to rely on the central server for triggering alerts - so we do that on the actual leaf syslog servers instead. However, it would be much better if we could actually centralize our alerting system (due to what we are alerting about). So I was wondering if syslog-ng's TCP transport layer could be turned into something like MySQL's master-slave mode: write to a cache file first, then write to remote server, and if that succeeds, remove from cache file. That way if a network outage occurred, the cache file would just get larger and larger, then when the network came up again, it would flow through without any records being lost. [I know the fifo option allows this in RAM - I guess all that I'm wondering about is could that be done on disk instead?. A cache file would survive restarts/etc.] -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1