radius authentication alert logging

after you change auth-priv-from (modify sys syslog...) and save (i.e. tmsh save sys config), can you check /etc/syslog-ng/syslog-ng.conf? is syslog-ng configuration changed accordingly?

this is mine.

 authpriv.*                                    /var/log/secure
filter f_authpriv {
    (facility(auth, authpriv) and level(err..emerg))
    or program(sshd)
    or (facility(auth,authpriv) and (program(httpd) or program(tamd)))
    or match("pam_audit")
    ;
};

destination d_secure {
   file("/var/log/secure" create_dirs(yes));
};

log {
   source(s_syslog_pipe);
   filter(f_authpriv);
   destination(d_secure);
};

by the way, have you customized syslog-ng configuration?