I've tried the various configurations in the FAQ and I still get sec.pl spawned by a shell. Then after killing syslog-ng, sec.pl doesn't exit. Below are the configs and the output from ptree. I'm using Solaris 7, syslog-ng 1.6.2, sec 2.2.2 and perl 5.00503. I'm thinking of adding stats(60) to the syslog-ng config and then using the -input_timeout and -timeout_script options for sec.pl, but I have figured out how the sub-script would tell the difference between the abandoned sec.pl and the new one that's a child of the current syslog-ng. as per FAQ: ----------- destination d_sec { program("/usr/local/sbin/sec.pl -intevents -input=\"-\" -conf=/usr/local/etc/sec.conf"); }; 25879 /usr/local/sbin/syslog-ng 25880 /bin/sh -c /usr/local/sbin/sec.pl -intevents -input="-" -conf=/usr/local/etc/se 25881 /usr/local/bin/perl -w /usr/local/sbin/sec.pl -intevents -input=- -conf=/usr/lo another config: --------------- destination d_sec { program("/usr/local/sbin/sec.pl -intevents -input=\"-\" -conf=/usr/local/etc/sec.conf > /var/log/sec.log 2>&1"); }; 26428 /usr/local/sbin/syslog-ng 26429 /bin/sh -c /usr/local/sbin/sec.pl -intevents -input="-" -conf=/usr/local/etc/se 26430 /usr/local/bin/perl -w /usr/local/sbin/sec.pl -intevents -input=- -conf=/usr/lo pure desperation: ----------------- destination d_sec { program("/usr/local/bin/perl -w /usr/local/sbin/sec.pl -intevents -input=\"-\" -conf=/usr/local/etc/sec.conf"); }; 27478 /usr/local/sbin/syslog-ng 27479 /bin/sh -c /usr/local/bin/perl -w /usr/local/sbin/sec.pl -intevents -input="-" 27480 /usr/local/bin/perl -w /usr/local/sbin/sec.pl -intevents -input=- -conf=/usr/lo -- "Computer science is as much about computers as astronomy is about telescopes" -- Edsger Dijkstra --------------------------------------------------------- Anthony Tonns, UNIX Administrator - atonns@mail.ivillage.com iVillage Inc., 500 Seventh Avenue, New York, NY 10018 - iVillage Inc. is a leading women's media company that includes iVillage.com, Women.com, gURL.com, Astrology.com, Promotions.com, iVillage Parenting Network, The Newborn Channel, Lamaze Publishing, Business Women's Network, Diversity Best Practices, Best Practices in Corporate Communications, and iVillage Consulting. The information contained in this communication may be confidential, is intended only for the use of the recipient named above, and may be construed under applicable law to be a commercial email. If you have received this communication in error, please delete this message from your computer system. If you are the recipient named above and do not wish to receive any future commercial emails, please reply to the sender with a message stating such preference.