[syslog-ng]100% newbie match question