So upstream syslog-ng seems to be behind in their documentation and still claims 3.37 is the newest, despite 3.38.1 being the oldest still in the gentoo tree (with 4.1.1-rX for ~arch and installed here). Never-the-less, even the 3.37 documentation says the mark option is deprecated/obsolete, with mark_freq being an alias for it for compatibility with 1.6.x (!!), so it seems Gentoo's default config file "needs some love". https://www.syslog-ng.com/technical-documents/doc/syslog-ng-open-source-edition/3.37/administration-guide/71#TOPIC-1829183 (search for mark() and/or mark_freq(), also mark-mode(), it's alphabetical so they're together but quite some way down...) Syslog-ng documentation isn't the easiest to decipher, but from my read, mark-mode() is (now) the critical setting here. All destinations (including console, etc) in Gentoo's default config use the file destination driver, which defaults to mark-mode(none) since we're not setting it explicitly. That turns off marking, and indeed, I've had no mark*() settings of any kind in my config for some time, with no mark lines showing up (tho I did reduce my stats line time to 6 hours from the gentoo-default 12). Apparently (from the commit closing bug #904562) hardened's default config doesn't have any explicit mark*() settings at all, so no changes need be made there.
