setting log file to just "syslog" (instead of "syslog:") uses the default facility