The syslog-ng 3.0 Administrator Guide

Group policies for the syslog-ng Agent can be specified at different levels, e.g., at the domain level, at the organization unit level, at the computer level, or also as a local policy of the computer. When evaluating its configuration settings, the syslog-ng Agent follows the standard policy-inheritance methods of Windows. If the configuration of the syslog-ng Agent is specified at multiple levels (e.g., on the domain level and also at the computer level), then the more specific (or lower level) setting is used (that is, the computer level in the above example). If a setting is not configured at a level, the setting of the next higher level is used (e.g., if something is not configured on the computer level, then the setting of the organization unit — or if it is not specified in the policy of organization unit, then the setting of the domain policy — is used). If a setting is not configured in any group policy, the syslog-ng Agent checks its local policy settings, and uses the local setting if available.