Steve wrote:
The presence of the above line is definitely what triggers the excessive CPU usage - it is almost as-if syslog-ng is 'busy-waiting' for the sshguard process. The sshguard process is running - but using zero CPU.destination sshguardproc { program("/usr/local/sbin/sshguard" template("$DATE $FULLHOST $MESSAGE\n")); };
I have this problem with syslog-ng versions 2.1.3 and 2.1.4 (the one with ~x86)...
This is very frustrating... having played around, the syslog-ng tends towards using 100% CPU when my server is otherwise quiet - if, and only if, I have the program destination... even if the destination is not used.

