The system log shows the event starting; it shows alarms occurring; but there is no INF message showing the event ending. I use the default 10 minute duration for events, so my database has 10 minutes missing when I go back to view past events.
If I go to the zmaudit log, I can see the event in question has been deleted with the following messages :
Filesystem event '1/33764' does not exist in database, deleting'
Found orphaned frame records for event 33764, deleting
So I know where the events are going - zmaudit is deleting them! I just don't know why!

It's possible this occurs because the system can't cope when 3 cameras alarm at the same time - is this likely? Any help appreciated!
My system is an Athlon 2000 with 512MB memory and a 4 port Grandtec Multi Capture Card running SuSE Linux 9.2 Pro, with 4 b/w cameras
The system has currently been up for 45 days and doesn't degrade with time so I don't think it's a memory leak.
I think zoneminder is great - so far I've captured the paperboy making escapes over my fences (sacked after warnings for serial offending!) and a deer nibbling at my garden, which amazed us as we live in town! When I've sorted this final problem, and found a good way to automatically keep the disk space in control, I'll be well pleased and making a donation.