Update firststeps-logging.md

docs/firststeps-logging.md

@@ -26,6 +26,8 @@ Redis keys will only hold logs from applications and filter out system messages
 
 ### Logging drivers
 
+#### Via docker-compose.override.yml
+
 Here is the good news: Since Docker has some great logging drivers, you can integrate mailcow: dockerized into your existing logging environment with ease.
 
 Create a `docker-compose.override.yml` and add, for example, this block to use the "gelf" logging plugin for `postfix-mailcow`:
@@ -40,7 +42,46 @@ services:
         gelf-address: "udp://graylog:12201"  
 ```
 
-If you want to change the logging driver globally, edit Dockers daemon configuration file `/etc/docker/daemon.json` and restart the Docker service:
+Another example for **Syslog**:
+
+```
+version: '2.1'
+services:
+
+  postfix-mailcow: # or any other
+    logging:
+      driver: "syslog"
+      options:
+        syslog-address: "udp://127.0.0.1:514"
+        syslog-facility: "local3"
+
+  dovecot-mailcow: # or any other
+    logging:
+      driver: "syslog"
+      options:
+        syslog-address: "udp://127.0.0.1:514"
+        syslog-facility: "local3"
+
+  rspamd-mailcow: # or any other
+    logging:
+      driver: "syslog"
+      options:
+        syslog-address: "udp://127.0.0.1:514"
+        syslog-facility: "local3"
+
+# For Rsyslog only:
+# To move local3 input to /var/log/mailcow.log and stop processing, create a file "/etc/rsyslog.d/docker.conf":
+
+local3.*        /var/log/mailcow.logs
+& ~
+
+# Restart rsyslog afterwards.
+
+```
+
+#### via daemon.json (globally)
+
+If you want to **change the logging driver globally**, edit Dockers daemon configuration file `/etc/docker/daemon.json` and restart the Docker service:
 
 ```
 {