Go to /etc/syslog-ng and едит syslog-ng.conf
the end of the original file looks like this:
####
source zimbra_src { unix-stream("/dev/log"; keep-alive(yes); max-connections(20)
; }; # zimbra
filter zimbra_local0 { facility(local0); }; # zimbra
filter zimbra_local1 { facility(local1); }; # zimbra
filter zimbra_auth { facility(auth); }; # zimbra
filter zimbra_mail { facility(mail); }; # zimbra
destination zimbra_mail { file("/var/log/zimbra.log" owner("zimbra")); }; # zimbra
destination zimbra_local1 { file("/var/log/zimbra-stats.log" owner("zimbra")); }; # zimbra
destination zimbra_local0 { file("/var/log/zimbra.log" owner("zimbra")); }; # zimbra
destination zimbra_auth { file("/var/log/zimbra.log" owner("zimbra")); }; # zimbra
log { source(zimbra_src); filter(zimbra_mail); destination(zimbra_mail); }; # zimbra
log { source(zimbra_src); filter(zimbra_local0); destination(zimbra_local0); }; # zimbra
log { source(zimbra_src); filter(zimbra_local1); destination(zimbra_local1); }; # zimbra
log { source(zimbra_src); filter(zimbra_auth); destination(zimbra_auth); }; # zimbra
########
what did is i:
# source zimbra_src { unix-stream("/dev/log"; keep-alive(yes); max-connections(20)
; }; # zimbra
filter zimbra_local0 { facility(local0); }; # zimbra
filter zimbra_local1 { facility(local1); }; # zimbra
filter zimbra_auth { facility(auth); }; # zimbra
filter zimbra_mail { facility(mail); }; # zimbra
destination zimbra_mail { file("/var/log/zimbra.log" owner("zimbra")); }; # zimbra
destination zimbra_local1 { file("/var/log/zimbra-stats.log" owner("zimbra")); }; # zimbra
destination zimbra_local0 { file("/var/log/zimbra.log" owner("zimbra")); }; # zimbra
destination zimbra_auth { file("/var/log/zimbra.log" owner("zimbra")); }; # zimbra
log { source(src); filter(zimbra_mail); destination(zimbra_mail); }; # zimbra
log { source(src); filter(zimbra_local0); destination(zimbra_local0); }; # zimbra
log { source(src); filter(zimbra_local1); destination(zimbra_local1); }; # zimbra
log { source(src); filter(zimbra_auth); destination(zimbra_auth); }; # zimbra
##############
and everything started to work
I hope it will work for you....
