Yes, that's correct. The responsibility to filter the system log entries and create separate log files based on content-specific rules falls on syslog-ng, and it does that with a process running in the background. I don't know the minute details, but that's the gist of its core functionality...