On another topic..... Anyone have any guidance on optimizing syslog-ng for high-volume systems? For example, what is a good range for sync(), and are there any other options that may assist in lowering CPU? We are not using any variables in the directory of filenames other than $HOST. Here's the current conf: options { log_fifo_size(1024); dns_cache(yes); use_dns(yes); chain_hostnames(no); keep_hostname(no); create_dirs(yes);}; source local { sun-streams("/dev/log"); internal(); }; source std_udp { udp( port(52001) ); }; destination all { file("/var/log/messages"); }; destination std { file("/syslog/std/current/$HOST" dir_perm(0755) perm(0644)); }; log { source(local); destination(all); }; log { source(std_udp); destination(std); }; TIA, Peter