syslog may give EPERM thats ok