I have just installed and configure syslog-ng on a couple of solaris boxes. However, I seem to be getting more then I wanted sent out to the ttys. Here is what I have done:

source s_all { sun-streams("/dev/log" door("/etc/.syslog_door"));
               internal();
               udp();
             };
filter f_EmergSanUser { level(emerg) and not facility(user); };
destination d_ttys { usertty("*"); };
log { source(s_all);
      filter(f_EmergSanUser);
      destination (d_ttys);
    };

I am trying to mimic the syslog.conf line:
*.emerg;user.none *

However, what I am getting is notice level messages on the ttys.

--
John C. Wingenbach
Broadband Technologies
Sr. Systems Administrator
Work: (919) 405-4627
Fax:  (919) 405-4544