pfSense » pfSense Packages

Summarized from the initial query over in the pfSense Forums (https://forum.pfsense.org/index.php?topic=91059.0):

The GUI for managing syslog-ng doesn't provide a means to sort/order any user-generated rules relative to the failover default rules. Although initial attempts to order rules using a naming convention (the default rules are all named "_DEFAULT"), the GUI nevertheless always places the default rules at the top of each object class. This prevents a user from being able to isolate specific syslog traffic from the default log file, which is a desirable feature and a common workflow.

While full manual sorting/validation of the rules would be a desirable end-goal, a minimal capability could be achieved by any of the following:
1. providing a checkbox that forced the three (3) default rules to be placed at the end of the syslog-ng config file,
2. providing a new free-text field in the Advanced tab which would be added to the beginning of the config file.
Such basic measures, while not "perfect" and certainly not satisfying all users, would provide a great deal of flexibility that users could take advantage of to satisfy most(?) workflows.