Following a recommendation in http://online.securityfocus.com/infocus/1633 I decided to try syslog-ng I installed it and it appears to run, but so far all I get is every 5 seconds: watcher[900]: Checking files... Is this normal - can I turn it off? -- Alex Finch, Research Fellow, Physics Department, Lancaster University.