It will be extremely easy to DoS the server if you have, say 10 MSGs of your kind in a second (or 100, or 1000).

Isn't that a problem in syslog-ng even without forking? I can see that forking means you can exhaust system resources with fewer messages, but there's no limit on how many messages syslog-ng can be made to handle, is there? I've long thought there should be some throttling of syslog activity; I haven't looked recently to see if syslog-ng provides any facilities for that, but whatever is right for logging to a file should be right for logging via fork, just with different numbers.

spawning a new process per MSG is probably a big overhead for nothing.

The overhead is insignificant in my case because 1) the cost of that one fork is a fraction of what is ultimately required to deliver an email; and 2) there would not normally be more than 1 per day. -- Bryan Henderson San Jose, California