Each report specifies which publisher to use :
<group id="unknown"> <description>Unknown log events : to be categorized</description> <condition> <match attribute="timestamp" type="contains">${date}</match> </condition> <report publisher="file"/> <report publisher="mail"> <param name="to">admin@localhost</param> </report> <plugin type="freq"> <param name="attribute">severity</param> </plugin> </group>