On Sun, 14 Dec 2008 02:25:17 +0000, Mike -- EMAIL IGNORED wrote: > Further examination shows numerous log lines that were detected on Dec > 12 by swatch using tail on the secure file but do not presently appear > in the secure file. However, they do appear in the messages file. > > Mike. Here are some tentative observations: If I do a vi on the secure file and write it from vi, it stops recording. If I do a "/var/init.d/syslog restart", the secure file starts recording. I still have no idea how swatch continues to function after the syslog stops recording. Mike.