Mine is exactly like that.
> What does this line look like in your mimedefang-filter?:
>
> md_graphdefang_log_enable('mail', 1);
>
> This is how mine looks where mail is the syslog facility (referenced back
> to what's in /etc/syslog.conf) and 1 is enabling logging. Check that on
> yours...