> When I restart slapd, local4 is used until it reads the plugin > peroperation line. Then for some unknown reason logging facility user is > used instead. Off the top of my head, I'd want to figure out if the plugin is calling openlog() (presumably after slapd does) && slapd doesn't specify a facility on every syslog(). In short...read the source. (Or maybe attach a debugger.)