The syslog-ng 3.0 Administrator Guide

In certain rare cases, you might have to create core dumps of the syslog-ng Agent to investigate a particular problem. When enabled, the syslog-ng Agent for Windows application creates core dumps automatically when it experiences an unexpected shutdown.

To enable core dumps, set the HKEY_LOCAL_MACHINE/Software/Balabit/syslog-ng Agent/WriteMinidump registry key to 1.

Core dumps are written into the installation folder of the syslog-ng Agent under the syslog-ng-agent.dmp filename. The size of a core file is typically about 40-50 MB.