Steve wrote:
Do others get this behaviour - is this a bug in syslog-ng?
Sorry for the multiple posts... a slight error on my part. The sshguard process wasn't running - a /bin/sh process trying to spawn it was running (there was no link from /usr/local... to the binary) and when the binary failed to execute - syslog-ng got itself into a tiz. Everything seems to work fine when I correct the path to the program.
Problem solved - but, I guess, this is a flaw in syslog-ng... I'd have hoped it would generate an error message rather than behave as it did.