/etc/syslog-ng/syslog-ng.conf

sync(2);

destination df_mail { file("/var/log/mail/mail.log"); };

destination df_facility_dot_info { file("/var/log/mail/$FACILITY.info"); };
destination df_facility_dot_notice { file("/var/log/mail/$FACILITY.notice"); };
destination df_facility_dot_warn { file("/var/log/mail/$FACILITY.warn"); };
destination df_facility_dot_err { file("/var/log/mail/$FACILITY.err"); };
destination df_facility_dot_crit { file("/var/log/mail/$FACILITY.crit"); };

# fw
destination df_fw { file("/var/log/fw.log"); };
destination df_fw_warn { file("/var/log/fw_warn.log"); };

filter f_auth { facility(auth, authpriv) and not facility(cron); };

filter f_syslog { not facility(auth, authpriv, cron, mail) and not match('Shorewall:'); };

filter f_kern { facility(kern) and not match('Shorewall:'); };

filter f_messages {
        level(info,notice,warn)
            and not facility(auth,authpriv,cron,daemon,mail,news) and not match('Shorewall:');
};

filter f_fw {
    level (info) and match ("Shorewall:");
};
filter f_fw_warn {
    level (warn) and match ("Shorewall:");
};

log {
        source(s_all);
        filter(f_cron);
        destination(df_cron);
};

log {
    source (s_all);
    filter (f_fw);
    destination (df_fw);
};

log {
    source (s_all);
    filter (f_fw_warn);
    destination (df_fw_warn);
};

mkdir /var/log/mail

http://www.balabit.com/network-security/syslog-ng/