The syslog developers should be shot to the moon, at least for their remote logging code: whenever a remote logging message arrives, a reverse DNS lookup is done for the source of the message. This is especially uncool when all messages come from the same source, and when the source is quite active. But, after all, that's what nscd is for, no? Anyway, it sucks hard, especially in my case, where the producer of the log messages is a quite slow computer (bintec router appliance), and also works as the DNS cache at the same time.