I've set up syslog-ng to create certain files with very specific permissions such as

destination tvc.cisco { file("/var/log/cisco/tvc-cisco.$PRIORITY" owner("admin") group("apache") perm(0640));};

files are created with permissions 0600. What am I missing?

umask I suppose. syslog-ng simply uses 0640 as open mode permissions and your umask (presumably 0600) overrides this setting. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt