Lighttpd

After updating to lighttpd/1.4.23 (ssl) something changed with the pipe (before these release only a single instance of ligttpd was created) now if cronolog or pipe is used it creates a child of lighttpd

accesslog.filename = "| /usr/local/sbin/cronolog /var/log/lighttpd/%Y/%m/%Y-%m-%d-access.log"

sockstat -4l

USER COMMAND PID FD PROTO LOCAL ADDRESS FOREIGN ADDRESS
www cronolog 81485 4 tcp4 67.228.37.157:80 :*
www sh 81484 4 tcp4 67.228.37.157:80 *:
www lighttpd 81448 4 tcp4 67.228.37.157:80 *:*

ps auxwww | grep light

www 81448 0.0 0.0 27532 3324 ?? SJ 3:17AM 0:00.01 /usr/local/sbin/lighttpd f /usr/local/etc/lighttpd.conf
www 81484 0.0 0.0 7024 1364 ?? IJ 3:17AM 0:00.00 sh -c /usr/local/sbin/cronolog /var/log/lighttpd/%Y/%m/%Y%m-%d-access.log
www 81485 0.0 0.0 2672 740 ?? SJ 3:17AM 0:00.00 /usr/local/sbin/cronolog /var/log/lighttpd/%Y/%m/%Y-%m-%d-access.log