Found the fault. I had installed syslog using the source first before I had tried using the spec file, and when I had updated it it still used the old executable. Also noted in the FAQ, missed this the other times - "Syslog-ng 1.5.3 added support for user definable log file formats.", as I was still using 1.4.13 this was the fault. Just installed 1.5.26, and used which to track down and delete the old executable. Problem solved