Is it normal, that I always see two syslog-ng processes runing?

Yes, by default syslog-ng has a supervisor process, which monitors the child. If the child crashes, the supervisor process automatically restarts it. Its behavior is controlled by the command line: '''--process-mode=<foreground|background|safe-background>''' The default is '''safe-background''' which enables the supervisor. The other two disables it. In practice the child is the main process, the supervisor is only there to restart it in the following cases:

  • it was killed by a signal
  • it exited with a non-zero return value When shutting down syslog-ng, the child process needs to receive a TERM signal, which will exit with a zero return value and also brings away the supervisor process.