[syslog-ng] syslog-ng ruleset confusion or bug?