... I'll try it once more.

If you have an untouched HD-Installation or installation to usb-stick with persistent memory "syslog" uses '/etc/syslog-knoppix.conf'.

If you hide '/etc/syslog-knoppix.conf' (by renaming it), "syslog" uses '/etc/syslog.conf'.

Why? You'll find the explanation for this behaviour in '/etc/init.d/knoppix-autoconfig' in the scriptblock 'start_log()'.

This doesn't work with CD-(DVD-)Live-Session!

Not yet mentioned: to prevent "run out of memory", logrotation of all files in /var/log is needed; logrotation will done by '/etc/cron.daily/logrotate'.

And for propper working of "cron" ('/etc/crontab') additional "anacron" must be installed! It is not installed in Knoppix by default.

Now you have logrotation of all the files in '/var/log'.

Greetings Werner * http://www.wp-schulz.de/knoppix/summary.html
Own Rescue-CD with Knoppix (Knoppix V6.4.4 remaster)