Listed below are all the DEFAULT settings in syslog-ng.conf from v2.0.9-4.1 for Debian. I've removed the comments and breaks on output for easier viewing. 1. OPTTIONS 2. SOURCES 3. DESTINATIONS 4. FILTERS 5. OUTPUT 1. OPTIONS: options { chain_hostnames(0); time_reopen(10); time_reap(360); #sync(0); log_fifo_size(2048); create_dirs(yes); #owner(root); group(adm); perm(0640); #dir_owner(root); #dir_group(root); dir_perm(0755); use_dns(no); #log_msg_size(2048); stats_freq(0); bad_hostname("^gconfd$"); }; 2. SOURCES: source s_all { internal(); unix-stream("/dev/log"); file("/proc/kmsg" log_prefix("kernel: ")); # udp(); }; 3. DESTINATIONS: destination df_auth { file("/var/log/auth.log"); }; destination df_syslog { file("/var/log/syslog"); }; destination df_cron { file("/var/log/cron.log"); }; destination df_daemon { file("/var/log/daemon.log"); }; destination df_kern { file("/var/log/kern.log"); }; destination df_lpr { file("/var/log/lpr.log"); }; destination df_mail { file("/var/log/mail.log"); }; destination df_user { file("/var/log/user.log"); }; destination df_uucp { file("/var/log/uucp.log"); }; destination df_facility_dot_info { file("/var/log/$FACILITY.info"); }; destination df_facility_dot_notice { file("/var/log/$FACILITY.notice"); }; destination df_facility_dot_warn { file("/var/log/$FACILITY.warn"); }; destination df_facility_dot_err { file("/var/log/$FACILITY.err"); }; destination df_facility_dot_crit { file("/var/log/$FACILITY.crit"); }; destination df_news_dot_notice { file("/var/log/news/news.notice" owner("news")); }; destination df_news_dot_err { file("/var/log/news/news.err" owner("news")); }; destination df_news_dot_crit { file("/var/log/news/news.crit" owner("news")); }; destination df_debug { file("/var/log/debug"); }; destination dp_xconsole { pipe("/dev/xconsole"); }; destination du_all { usertty("*"); }; 4. FILTERS: filter f_auth { facility(auth, authpriv); }; filter f_syslog { not facility(auth, authpriv); }; filter f_cron { facility(cron); }; filter f_daemon { facility(daemon); }; filter f_kern { facility(kern); }; filter f_lpr { facility(lpr); }; filter f_mail { facility(mail); }; filter f_news { facility(news); }; filter f_user { facility(user); }; filter f_uucp { facility(uucp); }; filter f_at_least_info { level(info..emerg); }; filter f_at_least_notice { level(notice..emerg); }; filter f_at_least_warn { level(warn..emerg); }; filter f_at_least_err { level(err..emerg); }; filter f_at_least_crit { level(crit..emerg); }; filter f_debug { level(debug) and not facility(auth, authpriv, news, mail); }; filter f_messages { level(info,notice,warn) and not facility(auth,authpriv,cron,daemon,mail,news); }; filter f_emerg { level(emerg); }; filter f_xconsole { acility(daemon,mail) or level(debug,info,notice,warn) or (facility(news) and level(crit,err,notice)); }; 5. OUTPUT: log { source(s_all); filter(f_auth); destination(df_auth); }; log { source(s_all); filter(f_syslog); destination(df_syslog);}; #log { source(s_all); filter(f_cron); destination(df_cron); }; log { source(s_all); filter(f_daemon); destination(df_daemon); }; log { source(s_all); filter(f_kern); destination(df_kern); }; log { source(s_all); filter(f_lpr); destination(df_lpr); }; log { source(s_all); filter(f_mail); destination(df_mail); }; log { source(s_all); filter(f_user); destination(df_user); }; log { source(s_all); filter(f_uucp); destination(df_uucp); }; log { source(s_all); filter(f_mail); filter(f_at_least_info); destination(df_facility_dot_info); }; log { ource(s_all); filter(f_mail); filter(f_at_least_warn); destination(df_facility_dot_warn); }; log { source(s_all); filter(f_mail); filter(f_at_least_err); destination(df_facility_dot_err); }; log { source(s_all); filter(f_news); filter(f_at_least_crit); destination(df_news_dot_crit); }; log { source(s_all); filter(f_news); filter(f_at_least_err); destination(df_news_dot_err); }; log { source(s_all); filter(f_news); filter(f_at_least_notice); destination(df_news_dot_notice); }; log { source(s_all); filter(f_debug); destination(df_debug); }; log { source(s_all); filter(f_messages); destination(df_messages); }; log { source(s_all); filter(f_emerg); destination(du_all); }; log { source(s_all); filter(f_xconsole); destination(dp_xconsole); };