We've got some on-going hang issues and one of the steps to fix them is to capture kernel messages on another host using the serial port. Easy enough. The problem is that every night something is happening to syslog such that our SuSEfirewall2 messages are getting sent to the serial port too. We get many connections a second during the day so the messages fill up the serial port and ultimately the machine slows to a crawl under load. We've figured out how to prevent the slowdown by turning off flow control, but what is causing syslog to send the firewall messages? So, right now my firewall logs are not getting written to /dev/ttyS0. But when I come in tomorrow morning they will be. If I run "/etc/rc.d/syslog restart" from a root shell the firewall logging will stop (to the serial port). I'm thinking something in logrotate (run from cron.daily) is causing this. I changed /etc/logrotate.d/syslog to run "/etc/init.d/syslog restart" in the postrotate section. Yet it is still logging the firewall entries. Any ideas? What would cause /etc/init.d/syslog restart to log messages one way when called from logrotate, but another way when called from a shell. Strange. Andy