FWIW, here's my syslog-knoppix.conf

By and large it puts syslog on vt12 and in /var/log/syslog
and puts kern.log in /var/log/kern.log.

# /etc/syslog-knoppix.conf
# Configuration file for syslogd started from /etc/init.d/knoppix-autoconfig
#
# This file is here merely to avoid logging to the system console when
# programs do an openlog() with LOG_CONS, which would clutter the output for
# screenreaders. acpid is known to do that.

# Normal logging messages go to /dev/tty12, except for passwords
*.*;auth,authpriv.none /dev/tty12

# ONLY Emergency messages are allowed to go to all consoles.
*.emerg *

# Add back kern.log and syslog
kern.* /var/log/kern.log
*.*;auth,authpriv.none /var/log/syslog