Dammit. Now I feel like a real idiot. Using savelog on debian it was touching the new argus.log file, which argus does not write over and keeps appending to the old file. Telling savelog to not touch a new file solves the problem, and the same with ra. Sorry guys. Chris