diff --git a/doc/_admin-guide/190_The_syslog-ng_manual_pages/001_dqtool_manual.md b/doc/_admin-guide/190_The_syslog-ng_manual_pages/001_dqtool_manual.md
index d8881a3..2cae17b 100644
--- a/doc/_admin-guide/190_The_syslog-ng_manual_pages/001_dqtool_manual.md
+++ b/doc/_admin-guide/190_The_syslog-ng_manual_pages/001_dqtool_manual.md
@@ -15,20 +15,20 @@ description: >-
     {{ site.product.short_name }}.
 ---
 
-## Synopsis
+## SYNOPSIS
 
-dqtool \[command\] \[options\]
+dqtool [command] [options]
 
-## Description
+## DESCRIPTION
 
 {% include doc/admin-guide/manpages-intro.md %}
 
 The dqtool application is a utility that can be used to display and
 format the messages stored in a disk-buffer file.
 
-## The cat command
+## THE CAT COMMAND
 
-```bash
+```shell
 cat [options] [file]
 ```
 
@@ -41,42 +41,38 @@ particular log messages, for example, **dqtool cat /var/log/messages.lgs
 
 The cat command has the following options:
 
-- \--debug or -d
-
+`--debug` or `-d`
     Print diagnostic and debugging messages to stderr.
 
-- \--help or -h
-
+`--help` or `-h`
     Display a brief help message.
 
-- \--template=\<template\> or -t
-
+`--template=<template>` or `-t`
     Format the messages using the specified template.
 
-- \--verbose or -v
-
+`--verbose` or `-v`
     Print verbose messages to stderr.
 
-- \--version or -V
-
+`--version` or `-V`
     Display version information.
 
-### Example: The cat command
+### EXAMPLE:
 
 ```bash
-./dqtool cat ../var/syslog-ng-00000.qf
+dqtool cat ../var/syslog-ng-00000.qf
 ```
 
 The output looks like:
-
+```config
 >Disk-buffer state loaded;
 >filename='../var/syslog-ng-00000.qf', qout_length='65', qbacklog_length='0', qoverflow_length='9205', qdisk_length='0'
 >Mar  3 10:52:05 tristram localprg[1234]: seq: 0000011630, runid: 1267609923, stamp: 2010-03-03T10:52:05 PADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADD
 >Mar  3 10:52:05 tristram localprg[1234]: seq: 0000011631, runid: 1267609923, stamp: 2010-03-03T10:52:05 PADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADD
+```
 
-## The relocate command
+## THE RELOCATE COMMAND
 
-```config
+```shell
 relocate [options] [files]
 ```
 
@@ -86,44 +82,41 @@ disk-queue) files. Note that this option modifies the persist file. Stop
 
 The relocate command has the following options:
 
-- \--all or -a
-
+`--all` or `-a`
     Relocate every disk-buffer file that is listed in the {{ site.product.short_name }}
     persist file.
 
-- \--new\_path or -n
-
+`--new_path` or `-n`
     The directory where you want to move the disk-bufffer files. For
     example: /var/disk-buffers
 
-- \--persist or -p
-
+`--persist` or `-p`
     The path to the {{ site.product.short_name }} persist file. The relocate command
     automatically updates the entries of the disk-buffer files in the
     persist file.
 
-### Examples
+### EXAMPLES:
 
 Relocate a single queue file:
 
 ```bash
-bin/dqtool relocate --new_path /tmp/dq --persist var/syslog-ng.persist /tmp/syslog-ng-00000.rqf
+dqtool relocate --new_path /tmp/dq --persist var/syslog-ng.persist /tmp/syslog-ng-00000.rqf
 ```
 
 Relocate multiple queue files:
 
 ```bash
-bin/dqtool relocate --new_path /tmp/dq --persist var/syslog-ng.persist /tmp/syslog-ng-00000.rqf /tmp/syslog-ng-00001.rqf
+dqtool relocate --new_path /tmp/dq --persist var/syslog-ng.persist /tmp/syslog-ng-00000.rqf /tmp/syslog-ng-00001.rqf
 ```
 
 Relocate every queue file:
 
 ```bash
-bin/dqtool relocate --new_path /tmp/dq --persist var/syslog-ng.persist --all
+dqtool relocate --new_path /tmp/dq --persist var/syslog-ng.persist --all
 ```
 
-## Files
+## FILES
 
-dqtool
+/opt/syslog-ng/bin/dqtool
 
 {% include doc/admin-guide/manpages-footnote.md %}
diff --git a/doc/_admin-guide/190_The_syslog-ng_manual_pages/002_loggen_manual.md b/doc/_admin-guide/190_The_syslog-ng_manual_pages/002_loggen_manual.md
index cad947f..df1aca2 100644
--- a/doc/_admin-guide/190_The_syslog-ng_manual_pages/002_loggen_manual.md
+++ b/doc/_admin-guide/190_The_syslog-ng_manual_pages/002_loggen_manual.md
@@ -14,13 +14,13 @@ description: >-
     loggen --- Generate syslog messages at a specified rate
 ---
 
-## Synopsis
+## SYNOPSIS
 
-loggen \[options\]
+loggen [options]
 
-target \[port\]
+target [port]
 
-## Description
+## DESCRIPTION
 
 {% include doc/admin-guide/manpages-intro.md %}
 
@@ -47,159 +47,138 @@ statistics:
 - bandwidth: The average bandwidth used for sending the messages in
     kilobytes/second.
 
-## Options
-
-- \--active-connections \<number-of-connections\>
+## OPTIONS
 
+`--active-connections <number-of-connections>`
     Number of connections loggen will use to send messages to the
     destination. This option is usable only when using TCP or TLS
     connections to the destination. Default value: 1
-
     The loggen utility waits until every connection is established
-    before starting to send messages. See also the \--idle-connections
+    before starting to send messages. See also the `--idle-connections`
     option.
 
-- \--csv or -C
-
+`--csv` or `-C`
     Send the statistics of the sent messages to stdout as CSV. This can
     be used for plotting the message rate.
 
-- \--dgram or -D
-
+`--dgram` or `-D`
     Use datagram socket (UDP or unix-dgram) to send the messages to the
-    target. Requires the \--inet option as well.
-
-- dont-parse or -d
+    target. Requires the --inet option as well.
 
+`--dont-parse` or `-d`
     Do not parse the lines read from the input files, send them as
     received.
 
-- \--help or -h
-
+`--help` or `-h`
     Display a brief help message.
 
-- \--idle-connection \<number-of-connections\>
-
+`--idle-connection <number-of-connections>`
     Number of idle connections loggen will establish to the destination.
     Note that loggen will not send any messages on idle connections, but
     the connection is kept open using keep-alive messages. This option
     is usable only when using TCP or TLS connections to the destination.
-    See also the \--active-connections option. Default value: 0
-
-- \--inet or -i
+    See also the --active-connections option. Default value: 0
 
+`--inet` or `-i`
     Use the TCP (by default) or UDP (when used together with the
     \--dgram option) protocol to send the messages to the target.
 
-- \--interval \<seconds\> or -I \<seconds\>
-
+`--interval <seconds>` or `-I <seconds>`
     The number of seconds loggen will run. Default value: 10
 
-    NOTE: When \--interval and \--number are used together, loggen will
-    send messages until the period set in \--interval expires or the
-    amount of messages set in \--number is reached, whichever happens
+    NOTE: When `--interval` and `--number` are used together, loggen will
+    send messages until the period set in `--interval` expires or the
+    amount of messages set in `--number` is reached, whichever happens
     first.
 
-- \--ipv6 or -6
-
+`--ipv6` or `-6`
     Specify the destination using its IPv6 address. Note that the
     destination must have a real IPv6 address.
 
-- \--loop-reading or -l
-
-    Read the file specified in \--read-file option in loop: loggen will
+`--loop-reading` or `-l`
+    Read the file specified in `--read-file` option in loop: loggen will
     start reading from the beginning of the file when it reaches the end
     of the file.
 
-- \--number \<number-of-messages\> or -n \<number-of-messages\>
-
+`--number <number-of-messages>` or `-n <number-of-messages>`
     Number of messages to generate.
 
-    NOTE: When \--interval and \--number are used together, loggen will
-    send messages until the period set in \--interval expires or the
-    amount of messages set in \--number is reached, whichever happens
+    NOTE: When `--interval` and `--number` are used together, loggen will
+    send messages until the period set in `--interval` expires or the
+    amount of messages set in `--number` is reached, whichever happens
     first.
 
-- \--no-framing or -F
-
+`--no-framing` or `-F`
     Do not use the framing of the IETF-syslog protocol style, even if
-    the \--syslog-proto option is set.
-
-- \--quiet or -Q
+    the `--syslog-proto` option is set.
 
+`--quiet` or `-Q`
     Display statistics only when loggen is finished. If not set, the
     statistics are displayed every second.
 
-- \--permanent or -T
-
+`--permanent` or `-T`
     Keep sending logs indefinitely, without time limit.
 
-- \--rate \<message/second\> or -r \<message/second\>
-
+`--rate <message/second>` or `-r <message/second>`
     The number of messages generated per second for every active
     connection. Default value: 1000
 
     If you want to change the message rate while loggen is running, send
     SIGUSR1 to double the message rate, or SIGUSR2 to halve it:
 
-    kill -USR1 \<loggen-pid\>kill -USR2 \<loggen-pid\>
-
-- \--read-file \<filename\> or -R \<filename\>
+    kill `-USR1 <loggen-pid>kill` `-USR2 <loggen-pid>`
 
+`--read-file <filename>` or `-R <filename>`
     Read the messages from a file and send them to the target. See also
-    the \--skip-tokens option.
-
+    the `--skip-tokens` option.
     Specify - as the input file to read messages from the standard input
     (stdio). Note that when reading messages from the standard input,
     loggen can only use a single thread. The -R -parameters must be
-    placed at end of command, like: loggen 127.0.0.1 1061 \--read-file -
-
-- \--sdata \<data-to-send\> or -p \<data-to-send\>
+    placed at end of command, like: loggen 127.0.0.1 1061 `--read-file` -
 
-    Send the argument of the \--sdata option as the `SDATA` part of
+`--sdata <data-to-send>` or `-p <data-to-send>`
+    Send the argument of the `--sdata` option as the `SDATA` part of
     IETF-syslog (RFC-5424 formatted) messages. Use it together with the
-    \--syslog-proto option. For example: **\--sdata \"\[test
-    name=\\\"value\\\"\]**
+    `--syslog-proto` option. 
+    
+    For example: 
 
-- \--size \<message-size\> or -s \<message-size\>
+    ```config
+    --sdata "[test name=\"value\"]
+    ```
 
+`--size <message-size>` or `-s <message-size>`
     The size of a syslog message in bytes. Default value: 256. Minimum
     value: 127 bytes, maximum value: 8192 bytes.
 
-- \--skip-tokens \<number\>
-
+`--skip-tokens <number>`
     Skip the specified number of space-separated tokens (words) at the
     beginning of every line. For example, if the messages in the file
-    look like foo bar message, \--skip-tokens 2 skips the foo bar part
+    look like foo bar message, --skip-tokens 2 skips the foo bar part
     of the line, and sends only the message part. Works only when used
-    together with the \--read-file parameter. Default value: 0
-
-- \--stream or -S
+    together with the --read-file parameter. Default value: 0
 
+`--stream` or `-S`
     Use a stream socket (TCP or unix-stream) to send the messages to the
     target.
 
-- \--syslog-proto or -P
-
+`--syslog-proto` or `-P`
     Use the new IETF-syslog message format. By
     default, loggen uses the legacy BSD-syslog message format.
     See also the \--no-framing option.
 
-- \--unix \</path/to/socket\> or -x \</path/to/socket\>
-
+`--unix </path/to/socket>` or `-x </path/to/socket>`
     Use a UNIX domain socket to send the messages to the target.
 
-- \--use-ssl or -U
-
+`--use-ssl` or `-U`
     Use an SSL-encrypted channel to send the messages to the target.
     Note that it is not possible to check the certificate of the target,
     or to perform mutual authentication.
 
-- \--version or -V
-
+`--version` or `-V`
     Display version number of syslog-ng.
 
-### Examples
+### EXAMPLES:
 
 The following command generates 100 messages per second for ten minutes,
 and sends them to port 2010 of the localhost via TCP. Each message is
@@ -241,7 +220,7 @@ localhost:
 loggen 127.0.0.1 1061 --read-file -
 ```
 
-## Files
+## FILES
 
 /opt/syslog-ng/bin/loggen
 
diff --git a/doc/_admin-guide/190_The_syslog-ng_manual_pages/003_pdbtool_manual.md b/doc/_admin-guide/190_The_syslog-ng_manual_pages/003_pdbtool_manual.md
index 9b10f68..df3271f 100644
--- a/doc/_admin-guide/190_The_syslog-ng_manual_pages/003_pdbtool_manual.md
+++ b/doc/_admin-guide/190_The_syslog-ng_manual_pages/003_pdbtool_manual.md
@@ -14,11 +14,11 @@ description: >-
     database rules
 ---
 
-## Synopsis
+## SYNOPSIS
 
-pdbtool \[command\] \[options\]
+pdbtool [command] [options]
 
-## Description
+## DESCRIPTION
 
 This manual page is only an abstract.
 
@@ -46,57 +46,57 @@ The pdbtool application is a utility that can be used to:
 - `dump the RADIX tree` built from the pattern database
     (or a part of it) to explore how the pattern matching works.
 
-## The dictionary command
+## THE DICTIONARY COMMAND
 
-dictionary \[options\]
+dictionary [options]
 
 Lists every name-value pair that can be set by the rules of the pattern
 database.
 
-- \--dump-tag or -T
+`--dump-tag` or `-T`
 
     List the tags instead of the names of the name-value pairs.
 
-- \--pdb \<path-to-file\> or -p \<path-to-file\>
+`--pdb <path-to-file>` or `-p <path-to-file>`
 
     Name of the pattern database file to use.
 
-- \--program \<programname\> or -P \<programname\>
+`--program <programname>` or `-P <programname>`
 
     List only the name-value pairs that can be set for the messages of
     the specified ${PROGRAM} application.
 
-## The dump command
+## THE DUMP COMMAND
 
-dump \[options\]
+dump [options]
 
 Display the RADIX tree built from the patterns. This shows how are the
 patterns represented in {{ site.product.short_name }} and it might also help to track
 down pattern-matching problems. The dump utility can dump the tree used
 for matching the `PROGRAM` or the `MSG` parts.
 
-- \--debug or -d
+`--debug` or `-d`
 
     Enable debug/diagnostic messages on stderr.
 
-- \--pdb or -p
+`--pdb` or `-p`
 
     Name of the pattern database file to use.
 
-- \--program or -P
+`--program` or `-P`
 
     Displays the RADIX tree built from the patterns belonging to the
     ${PROGRAM} application.
 
-- \--program-tree or -T
+`--program-tree` or `-T`
 
     Display the ${PROGRAM} tree.
 
-- \--verbose or -v
+`--verbose` or `-v`
 
     Enable verbose messages on stderr.
 
-### Example and sample output
+### EXAMPLE:
 
 ```bash
 pdbtool dump -p patterndb.xml  -P 'sshd'
@@ -122,9 +122,9 @@ pdbtool dump -p patterndb.xml  -P 'sshd'
                     '2' rule_id='fc44a9fe-75fd-11dd-9bba-001e6806451b'
 ```
 
-## The match command
+## THE MATCH COMMAND
 
-match \[options\]
+match [options]
 
 Use the match command to test the rules in a pattern database. The
 command tries to match the specified message against the patterns of the
@@ -143,26 +143,26 @@ information:
 
 The match command has the following options:
 
-- \--color-out or -c
+`--color-out` or `-c`
 
     Color the terminal output to highlight the part of the message that
     was successfully parsed.
 
-- \--debug or -d
+`--debug` or `-d`
 
     Enable debug/diagnostic messages on stderr.
 
-- \--debug-csv or -C
+`--debug-csv` or `-C`
 
-    Print the debugging information returned by the \--debug-pattern
+    Print the debugging information returned by the `--debug-pattern`
     option as comma-separated values.
 
-- \--debug-pattern or -D
+`--debug-pattern` or `-D`
 
     Print debugging information about the pattern matching. See also the
-    \--debug-csv option.
+    `--debug-csv` option.
 
-- \--file=\<filename-with-path\> or -f
+`--file=<filename-with-path>` or `-f`
 
     Process the messages of the specified log file with the pattern
     database. This option allows to classify messages offline, and to
@@ -170,35 +170,35 @@ The match command has the following options:
     messages from the standard input (stdin), specify a hyphen (-)
     character instead of a filename.
 
-- \--filter=\<filter-expression\> or -F
+`--filter=<filter-expression>` or `-F`
 
     Print only messages matching the specified {{ site.product.short_name }} filter
     expression.
 
-- \--message or -M
+`--message` or `-M`
 
     The text of the log message to match (only the `MESSAGE` part
     without the syslog headers).
 
-- \--pdb or -p
+`--pdb` or `-p`
 
     Name of the pattern database file to use.
 
-- \--program or -P
+`--program` or `-P`
 
     Name of the program to use, as contained in the `PROGRAM` part of
     the syslog message.
 
-- \--template=\<template-expression\> or -T
+`--template=<template-expression>` or `-T`
 
     A {{ site.product.short_name }} template expression that is used to format the output
     messages.
 
-- \--verbose or -v
+`--verbose` or `-v`
 
     Enable verbose messages on stderr.
 
-### Example - check
+### EXAMPLE: CHECK
 
 The following command checks if the patterndb.xml file recognizes the
 Accepted publickey for myuser from 127.0.0.1 port 59357 ssh6 message:
@@ -207,7 +207,7 @@ Accepted publickey for myuser from 127.0.0.1 port 59357 ssh6 message:
 pdbtool match -p patterndb.xml -P sshd -M "Accepted publickey for myuser from 127.0.0.1 port 59357 ssh6"
 ```
 
-### Example - apply
+### EXAMPLE: APPLY
 
 The following example applies the sshd.pdb pattern database file to the
 log messages stored in the /var/log/messages file, and displays only the
@@ -219,9 +219,9 @@ pdbtool match -p sshd.pdb \
     –filter ‘tags(“usracct”);’
 ```
 
-## The merge command
+## THE MERGE COMMAND
 
-merge \[options\]
+merge [options]
 
 Use the merge command to combine separate pattern database files into a
 single file (pattern databases are usually stored in separate files per
@@ -230,40 +230,33 @@ format, it is automatically updated to the latest format (V3). See the
 The {{ site.product.short_name }} Administrator Guide for
 details on the different pattern database versions.
 
-- \--debug or -d
-
+`--debug` or `-d`
     Enable debug/diagnostic messages on stderr.
 
-- \--directory or -D
-
+`--directory` or `-D`
     The directory that contains the pattern database XML files to be
     merged.
 
-- \--glob or -G
-
+`--glob` or `-G`
     Specify filenames to be merged using a glob pattern, for example,
     using wildcards. For details on glob patterns, see man glob. This
     pattern is applied only to the filenames, and not on directory
     names.
 
-- \--pdb or -p
-
+`--pdb` or `-p`
     Name of the output pattern database file.
 
-- \--recursive or -r
-
+`--recursive` or `-r`
     Merge files from subdirectories as well.
 
-- \--sort or -s
-
+`--sort` or `-s`
     Sort files into alphabetic order during the merge (first sort by
     filename, then by directory name).
 
-- \--verbose or -v
-
+`--verbose` or `-v`
     Enable verbose messages on stderr.
 
-### Example - merge
+### EXAMPLE: MERGE
 
 ```bash
 pdbtool merge --recursive --directory /home/me/mypatterns/  --pdb /var/lib/syslog-ng/patterndb.xml
@@ -273,9 +266,11 @@ Currently it is not possible to convert a file without merging, so if
 you only want to convert an older pattern database file to the latest
 format, you have to copy it into an empty directory.
 
-## The patternize command
+## THE PATTERNIZE COMMAND
 
-patternize \[options\]
+```shell
+patternize [options]
+```
 
 Automatically create a pattern database from a log file containing a
 large number of log messages. The resulting pattern database is printed
@@ -286,97 +281,84 @@ databases and message parsers, see the [The {{ site.product.short_name }} Admini
 (https://www.syslog-ng.com/). The patternize command is available
 only in version 3.2 and later.
 
-- \--debug or -d
-
+`--debug` or `-d`
     Enable debug/diagnostic messages on stderr.
 
-- \--file=\<path\> or -f
-
+`--file=<path>` or `-f`
     The logfile containing the log messages to create patterns from. To
     receive the log messages from the standard input (stdin), use -.
 
-- \--iterate-outliers or -o
-
+`--iterate-outliers` or `-o`
     Recursively iterate on the log lines to cover as many log messages
     with patterns as possible.
 
-- \--named-parsers or -n
-
+`--named-parsers` or `-n`
     The number of example log messages to include in the pattern
     database for every pattern. Default value: 1
 
-- \--no-parse or -p
-
+`--no-parse` or `-p`
     Do not parse the input file, treat every line as the message part of
     a log message.
 
-- \--samples=\<number-of-samples\>
-
+`--samples=<number-of-samples>`
     Include a generated name in the parsers, for example,
     **.dict.string1**, **.dict.string2**, and so on.
 
-- \--support=\<number\> or -S
-
+`--support=<number>` or `-S`
     A pattern is added to the output pattern database if at least the
     specified percentage of log messages from the input logfile match
     the pattern. For example, if the input logfile contains 1000 log
-    messages and the \--support=3.0 option is used, a pattern is created
+    messages and the `--support=3.0` option is used, a pattern is created
     only if the pattern matches at least 3 percent of the log messages
     (that is, 30 log messages). If patternize does not create enough
     patterns, try to decrease the support value.
-
     Default value: 4.0
 
-- \--verbose or -v
-
+`--verbose` or `-v`
     Enable verbose messages on stderr.
 
-### Example - patternize
+### EXAMPLE: PATTERINZE
 
 ```config
 pdbtool patternize --support=2.5 --file=/var/log/messages
 ```
 
-## The test command
+## THE TEST COMMAND
 
-test \[options\]
+```shell
+test [options]
+```
 
 Use the test command to validate a pattern database XML file. Note that
 you must have the xmllint application installed. The test command is
 available only in {{ site.product.short_name }} version 3.2 and later.
 
-- \--color-out or -c
-
+`--color-out` or `-c`
     Enable coloring in terminal output.
 
-- \--debug or -d
-
+`--debug` or `-d`
     Enable debug/diagnostic messages on stderr.
 
-- \--debug or -D
-
+`--debug` or `-D`
     Print debugging information on non-matching patterns.
 
-- \--rule-id or -r
-
+`--rule-id` or `-r`
     Test only the patterndb rule (specified by its rule id) against its
     example.
 
-- \--validate
-
+`--validate`
     Validate a pattern database XML file.
 
-- \--verbose or -v
-
+`--verbose` or `-v`
     Enable verbose messages on stderr.
 
-### Example - test
+### EXAMPLE: TEST
 
 ```bash
 pdbtool test --validate /home/me/mypatterndb.pdb
 ```
 
-## Files
+## FILES
 
 /opt/syslog-ng/
 
diff --git a/doc/_admin-guide/190_The_syslog-ng_manual_pages/004_persist-tool_manual.md b/doc/_admin-guide/190_The_syslog-ng_manual_pages/004_persist-tool_manual.md
index 0cefb90..613dfbc 100644
--- a/doc/_admin-guide/190_The_syslog-ng_manual_pages/004_persist-tool_manual.md
+++ b/doc/_admin-guide/190_The_syslog-ng_manual_pages/004_persist-tool_manual.md
@@ -10,14 +10,14 @@ id: adm-man-persist-tool
 manid: 1
 manname: persist-tool
 description: >-
-    persist-tool --- {{ site.product.short_name }} configuration file
+    persist-tool - {{ site.product.short_name }} configuration file
 ---
 
-## Synopsis
+## SYNOPSIS
 
 persist-tool [command] [options]
 
-## Description
+## DESCRIPTION
 
 This manual page is only an abstract.
 
@@ -31,77 +31,74 @@ Limitations:
 * The persist-state functions can be used only with `SLP4` or newer persist files. Older persist files are not supported.
 * Wildcard characters are not supported in file and directory names.
 
-## The dump command
+## THE DUMP COMMAND
 
+```shell
 dump [options] [persist_file]
+```
 
 Use the `dump` command to print the current content of the persist file in JSON format to the console.
 
 The `dump` command has the following options:
-* `--help` or `-?`
-
-    Display a brief help message.
+`--help` or `-?`
+    Display a brief help message. For example:
 
-### Example: persist-tool dump
+    ```config
+        persist-tool dump /opt/syslog-ng/var/syslog-ng persist
+    ``` 
+    A valid output is the following:
 
-```config
-persist-tool dump /opt/syslog-ng/var/syslog-ng.persist
-```
+    ```config
+    run_id = { "value": "00 00 00 00 0C 00 00 00 " }
+    host_id = { "value": "00 00 00 00 5F 49 2F 01 " }
+    ```
 
-A valid output is the following:
+## THE ADD COMMAND
 
-```config
-run_id = { "value": "00 00 00 00 0C 00 00 00 " }
-host_id = { "value": "00 00 00 00 5F 49 2F 01 " }
+```shell
+add [options] [input_file]
 ```
 
-## The add command
-
-add [options] [input_file] 
-
 Use the `add` command to add or modify a specified state-entry in the persist file. The state-entry should be in the same format as the `dump` command displays it. If the given state-entry already exists, it will be updated. Otherwise, a new value will be added. If the given persist state is invalid, it will be skipped.
 
 To use the `add` command: use `persist-tool dump` to print the content of the current persist file, and redirect it to a file. Edit the content of this file. Use `persist-tool` add with this file to modify the persist.
 
 The `add` command has the following options:
-* `--help` or `-?`
-
+`--help` or `-?`
     Display a brief help message.
-* `--output-dir=<directory>` or `-o`
 
+`--output-dir=<directory>` or `-o`
     Required parameter. The directory where the persist file is located at. The name of the persist file stored in this directory must be syslog-ng.persist.
-* `--persist-name=<filename>` or `-p`
 
-    Optional parameter. The name of the persist file to generate. Default value: syslog-ng.persist.
+`--persist-name=<filename>` or `-p`
+    Optional parameter. The name of the persist file to generate. Default value: syslog-ng.persist. For example:
 
-### Example: add dump_persist
+    ``` shell
+    /opt/syslog-ng/bin/persist-tool add dump_persist -o .
+    ```
 
-```config
-/opt/syslog-ng/bin/persist-tool add dump_persist -o .
-```
+    A valid output is the following:
 
-A valid output is the following:
+    ```config
+    log_reader_curpos(Application)      OK
+    affile_sd_curpos(/var/aaa.txt)        OK
+    ```
 
-```config
-log_reader_curpos(Application)      OK
-affile_sd_curpos(/var/aaa.txt)        OK
-```
+    An invalid output is the following:
 
-An invalid output is the following:
-
-```config
-log_reader_curpos(Application)      OK
-wrong
-FAILED (error: Invalid entry syntax)
-affile_sd_curpos(/var/aaa.txt)        OK
-```
+    ```config
+    log_reader_curpos(Application)      OK
+    wrong
+    FAILED (error: Invalid entry syntax)
+    affile_sd_curpos(/var/aaa.txt)        OK
+    ```
 
-## Files
+## FILES
 
 /opt/syslog-ng/bin/persist-tool
 
-## See also
+## SEE ALSO
 
-The syslog-ng.conf manual page
+`syslog-ng.conf`(5)
 
-The syslog-ng OSE manual page 
\ No newline at end of file
+{% include doc/admin-guide/manpages-footnote.md %}
\ No newline at end of file
diff --git a/doc/_admin-guide/190_The_syslog-ng_manual_pages/006_syslog-ng_conf.md b/doc/_admin-guide/190_The_syslog-ng_manual_pages/006_syslog-ng_conf.md
index 1caa979..437127e 100644
--- a/doc/_admin-guide/190_The_syslog-ng_manual_pages/006_syslog-ng_conf.md
+++ b/doc/_admin-guide/190_The_syslog-ng_manual_pages/006_syslog-ng_conf.md
@@ -13,11 +13,11 @@ description: >-
     syslog-ng.conf - {{ site.product.short_name }} configuration file
 ---
 
-## Synopsis
+## SYNOPSIS
 
 syslog-ng.conf
 
-## Description
+## DESCRIPTION
 
 This manual page is only an abstract.
 
@@ -30,7 +30,7 @@ and collect the log messages from the various applications, files, and
 other sources. The clients send all important log messages to the remote
 {{ site.product.short_name }} PE server, where the server sorts and stores them.
 
-## Basic concepts of {{ site.product.short_name }}
+## BASIC CONCEPTS OF {{ site.product.short_name }}
 
 The {{ site.product.short_name }} application reads incoming messages and forwards them
 to the selected destinations. The {{ site.product.short_name }} application can receive
@@ -57,7 +57,7 @@ and rewriting rules. Parsers segment messages into different fields to
 help processing the messages, while rewrite rules modify the messages by
 adding, replacing, or removing parts of the messages.
 
-## Configuring {{ site.product.short_name }}
+## CONFIGURING {{ site.product.short_name }}
 
 - The main body of the configuration file consists of object
     definitions: sources, destinations, logpaths define which log
@@ -212,7 +212,7 @@ configuration file using the following syntax:
 options { option1(params); option2(params); ... };
 ```
 
-### Example: Using global options
+For example:
 
 To disable domain name resolving, add the following line to the
 {{ site.product.short_name }} configuration file:
@@ -224,7 +224,7 @@ options { use-dns(no); };
 The sources, destinations, and filters available in {{ site.product.short_name }} are
 listed below.  
 
-## Table 1: Source drivers available in {{ site.product.short_name }}
+## TABLE 1: SOURCE DRIVERS AVAILABLE IN {{ site.product.short_name }}
 
 |Name                                |Description
 |---|---
@@ -248,7 +248,7 @@ listed below.
 |unix-stream()                 |Opens the specified unix socket in SOCK_STREAM mode and listens for incoming messages.
 |stdin()                       |Collects messages from the standard input stream.
 
-## Table 2: Destination drivers available in syslog-ng
+## TABLE 2: DESTINATION DRIVERS AVAILABLE IN {{ site.product.short_name }}
 
 |Name                   |Description
 |---|---
@@ -276,7 +276,7 @@ listed below.
 |unix-stream()|    Sends messages to the specified unix socket in SOCK_STREAM style (Linux).
 |usertty()|        Sends messages to the terminal of the specified user, if the user is logged in.
 
-## Table 3: Filter functi|ons available in {{ site.product.short_name }}
+## TABLE 3: FILTER FUNCTIONS AVAILABLE IN {{ site.product.short_name }}
 
 |Name                         |Description
 |---------------------------- |-------------
@@ -292,7 +292,7 @@ listed below.
 |source()|               | Select messages of the specified {{ site.product.short_name }} source statement.
 |tags()|                 | Select messages having the specified tag.
 
-## Files
+## FILES
 
 /opt/syslog-ng/
 
diff --git a/doc/_admin-guide/190_The_syslog-ng_manual_pages/007_syslog-ng_control_tool_manual.md b/doc/_admin-guide/190_The_syslog-ng_manual_pages/007_syslog-ng_control_tool_manual.md
index 3eace87..39c9b8d 100644
--- a/doc/_admin-guide/190_The_syslog-ng_manual_pages/007_syslog-ng_control_tool_manual.md
+++ b/doc/_admin-guide/190_The_syslog-ng_manual_pages/007_syslog-ng_control_tool_manual.md
@@ -15,11 +15,11 @@ description: >-
     and trace modes in {{ site.product.short_name }}
 ---
 
-## Synopsis
+## SYNOPSIS
 
 syslog-ng-ctl \[command\] \[options\]
 
-## Description
+## DESCRIPTION
 
 {% include doc/admin-guide/manpages-intro.md %}
 
@@ -35,7 +35,7 @@ The syslog-ng-ctl application is a utility that can be used to:
 
 - reload the configuration of {{ site.product.short_name }}.
 
-## Enabling troubleshooting messages
+## ENABLE TROUBLESHOOTING MESSAGES
 
 command \[options\]
 
@@ -75,7 +75,7 @@ command to specify the socket to use.
     specified, {{ site.product.short_name }} will log such messages to its internal
     source.
 
-### Example
+### EXAMPLE
 
 ```bash
 syslog-ng-ctl verbose --set=on
@@ -84,8 +84,8 @@ syslog-ng-ctl verbose --set=on
 ## syslog-ng-ctl query
 
 The {{ site.product.short_name }} application stores various data, metrics, and
-statistics in a hash table. Every property has a name and a value. For
-example:
+statistics in a hash table. Every property has a name and a value.
+For example:
 
 ```text
 [syslog-ng]
@@ -106,7 +106,7 @@ also use the ? and \* wildcards. For example:
 The nodes and properties available in the tree depend on your {{ site.product.short_name }} configuration (that is, the sources, destinations, and other objects
 you have configured), and also on your stats-level() settings.
 
-## The list command
+## THE LIST COMMAND
 
 syslog-ng-ctl query list
 
@@ -164,7 +164,7 @@ The syslog-ng-ctl query list command has the following options:
     Use \--reset to set the selected counters to 0 after executing the
     query.
 
-## Displaying metrics and statistics
+## DISPLAYING METRICS AND STATISTICS
 
 syslog-ng-ctl query get \[options\]
 
@@ -178,42 +178,36 @@ and the metrics related to each destination. An example output:
 
 The syslog-ng-ctl query get command has the following options:
 
-- \--sum
-
+`--sum`
     Add up the result of each matching node and return only a single
-    number.
-
-    For example, the syslog-ng-ctl query get \--sum
-    \"destination\*.dropped\" command displays the number of messages
+    number. For example, the syslog-ng-ctl query get `--sum "destination*.dropped"` command displays the number of messages
     dropped by the {{ site.product.short_name }} instance.
 
-- \--reset
-
-    Use \--reset to set the selected counters to 0 after executing the
+`--reset`
+    Use `--reset` to set the selected counters to `0` after executing the
     query.
 
-## The stats command
+## THE STATS COMMAND
 
-stats \[options\]
+```shell
+stats [options]
+```
 
 Use the stats command to display statistics about the processed
 messages. For details about the displayed statistics,
 see The {{ site.product.short_name }} Administration Guide.
 The stats command has the following options:
 
-- \--control=\<socket\> or -c
-
+`--control=<socket>` or `-c`
     Specify the socket to use to access syslog-ng PE. Only needed when
     using a non-standard socket.
 
-- \--reset=\<socket\> or -r
-
+`--reset=<socket>` or `-r`
     Reset all statistics to zero, except for the queued counters. (The
     queued counters show the number of messages in the message queue of
     the destination driver, waiting to be sent to the destination.)
 
-- \--remove-orphans
-
+`--remove-orphans`
     Safely removes all counters that are not referenced by any syslog-ng
     stat producer objects.
 
@@ -230,7 +224,7 @@ The stats command has the following options:
     removes only dynamic counters that have a timestamp field set.
     {: .notice--info}
 
-### Example - stats
+### EXAMPLE: STATS
 
 ```bash
 syslog-ng-ctl stats
@@ -266,9 +260,9 @@ An example output:
 >center;;queued;a;processed;0
 >destination;df_facility_dot_err;;a;processed;0
 
-## Handling password-protected private keys
+## HANDLING PASSWORD-PROTECTED PRIVATE KEYS
 
-syslog-ng-ctl credentials \[options\]
+syslog-ng-ctl credentials [options]
 
 The syslog-ng-ctl credentials status command allows you to query the
 status of the private keys that {{ site.product.short_name }} uses in the network() and
@@ -277,9 +271,9 @@ password-protected private keys using the syslog-ng-ctl credentials add
 command. For details on using password-protected keys, see
 The {{ site.product.short_name }} Administrator Guide.
 
-## Displaying the status of private keys
+## DISPLAYING THE STATUS OF PRIVATE KEYS
 
-syslog-ng-ctl credentials status \[options\]
+syslog-ng-ctl credentials status [options]
 
 The syslog-ng-ctl credentials status command allows you to query the
 status of the private keys that {{ site.product.short_name }} uses in the network() and
@@ -288,7 +282,7 @@ their status. For example:
 
 ```bash
 syslog-ng-ctl credentials status
-```   
+```
 
 >Secret store status:
 >/home/user/ssl_test/client-1/client-encrypted.key SUCCESS
@@ -304,14 +298,14 @@ The following log message also notifies you of PENDING passphrases:
 
 >Waiting for password; keyfile='private.key'
 
-- \--control=\<socket\> or -c
+`--control=<socket>` or `-c`
 
     Specify the socket to use to access {{ site.product.short_name }}. Only needed when
     using a non-standard socket.
 
-## Opening password-protected private keys
+## OPENING PASSWORD-PROTECTED PRIVATE KEYS
 
-syslog-ng-ctl credentials add \[options\]
+syslog-ng-ctl credentials add [options]
 
 You can add the passphrase to a password-protected private key file
 using the following command. {{ site.product.short_name }} will display a prompt for you
@@ -335,24 +329,21 @@ example:
 echo "<passphrase-of-the-key>" | syslog-ng-ctl credentials add --id=<path-to-the-key>
 ```
 
-- \--control=\<socket\> or -c
-
+`--control=<socket>` or `-c`
     Specify the socket to use to access syslog-ng PE. Only needed when
     using a non-standard socket.
 
-- \--id=\<path-to-the-key\> or -i
-
+`--id=<path-to-the-key>` or `-i`
     The path to the password-protected private key file. This is the
     same path that you use in the key-file() option of the {{ site.product.short_name }}
     configuration file.
 
-- \--secret=\<passphrase-of-the-key\> or -s
-
+`--secret=<passphrase-of-the-key>` or `-s`
     The password or passphrase of the private key.
 
-## Displaying the configuration
+## DISPLAYING THE CONFIGURATION
 
-syslog-ng-ctl config \[options\]
+syslog-ng-ctl config [options]
 
 Use the syslog-ng-ctl config command to display the configuration that
 {{ site.product.short_name }} is currently running. Note by default, only the content of
@@ -360,9 +351,9 @@ the main configuration file are displayed, included files are not
 resolved. To resolve included files and display the entire
 configuration, use the syslog-ng-ctl config \--preprocessed command.
 
-## Reloading the configuration
+## RELOADING thE CONFIGURATION
 
-syslog-ng-ctl reload \[options\]
+syslog-ng-ctl reload [options]
 
 Use the syslog-ng-ctl reload command to reload the configuration file of
 {{ site.product.short_name }} without having to restart the {{ site.product.short_name }} application.
@@ -371,7 +362,7 @@ The syslog-ng-ctl reload works like a SIGHUP.
 The syslog-ng-ctl reload command returns 0 if the operation was
 successful, 1 otherwise.
 
-## Files
+## FILES
 
 /opt/syslog-ng/sbin/syslog-ng-ctl
 
diff --git a/doc/_admin-guide/190_The_syslog-ng_manual_pages/008_syslog-ng_debun_tool_manual.md b/doc/_admin-guide/190_The_syslog-ng_manual_pages/008_syslog-ng_debun_tool_manual.md
index 7bb1c48..b33774f 100644
--- a/doc/_admin-guide/190_The_syslog-ng_manual_pages/008_syslog-ng_debun_tool_manual.md
+++ b/doc/_admin-guide/190_The_syslog-ng_manual_pages/008_syslog-ng_debun_tool_manual.md
@@ -14,11 +14,11 @@ description: >-
     syslog-ng-debun --- syslog-ng DEBUg buNdle generator
 ---
 
-## Synopsis
+## SYNOPSIS
 
-syslog-ng-debun \[options\]
+syslog-ng-debun [options]
 
-## Description
+## DESCRIPTION
 
 {% include doc/admin-guide/manpages-intro.md %}
 
@@ -26,39 +26,33 @@ The syslog-ng-debun tool collects and saves information about your
 {{ site.product.short_name }} installation, making troubleshooting easier, especially if
 you ask help about your {{ site.product.short_name }} related problem.
 
-## General Options
-
-- -r
+## GENERAL OPTIONS
 
+`-r`
     Run syslog-ng-debun. Using this option is required to actually
     execute the data collection with syslog-ng-debun. It is needed to
     prevent accidentally running syslog-ng-debun.
 
-- -h
-
+`-h`
     Display the help page.
 
-- -l
-
+`-l`
     Do not collect privacy-sensitive data, for example, process tree,
     fstab, and so on. If you use with -d, then the following parameters
     will be used for debug mode:-Fev
 
-- -R \<directory\>
-
+`-R <directory>`
     The directory where syslog-ng PE is installed instead of
     /opt/syslog-ng.
 
-- -W \<directory\>
-
+`-W <directory>`
     Set the working directory, where the debug bundle will be saved.
     Default value: /tmp. The name of the created file is
     syslog.debun.${host}.${date}.${3-random-characters-or-pid}.tgz
 
-## Debug mode options
-
-- -d
+## DEBUG MODE OPTIONS
 
+`-d`
     Start {{ site.product.short_name }} in debug mode, using the -Fedv \--enable-core
     options.
 
@@ -68,54 +62,46 @@ you ask help about your {{ site.product.short_name }} related problem.
     mode, press Enter.
     {: .notice--warning}
 
-- -D \<options\>
-
+`-D <options>`
     Start {{ site.product.short_name }} in debug mode, using the specified command-line
     options. To exit debug mode, press Enter.
 
-- -t \<seconds\>
-
+`-t <seconds>`
     Run {{ site.product.short_name }} in noninteractive debug mode for \<seconds\>, and
     automatically exit debug mode after the specified number of seconds.
 
-- -w \<seconds\>
-
-    Wait \<seconds\> seconds before starting debug mode.
+`-w <seconds>`
+    Wait <seconds> seconds before starting debug mode.
 
-## System call tracing
+## SYSTEM CALL TRACING
 
-- -s
-
-    Enable syscall tracing (strace -f or truss -f). Note that using -s
+`-s`
+    Enable syscall tracing (strace -f or truss -f). Note that using `-s`
     itself does not enable debug mode, only traces the system calls of
     an already running {{ site.product.short_name }} process. To trace system calls in
-    debug mode, use both the -s and -d options.
+    debug mode, use both the `-s` and `-d` options.
 
-## Packet capture options
+## PACKET CAPTURE OPTIONS
 
 Capturing packets requires a packet capture tool on the host. The
 syslog-ng-debun tool attempts to use tcpdump on most platforms, except for
 Solaris, where it uses snoop.
 
-- -i \<interface\>
-
+`-i <interface>`
     Capture packets only on the specified interface, for example, eth0.
 
-- -p
-
+`-p`
     Capture incoming packets using the following filter: port 514 or
     port 601 or port 53
 
-- -P \<options\>
-
+`-P <options>`
     Capture incoming packets using the specified filter.
 
-- -t \<seconds\>
-
+`-t <seconds>`
     Run {{ site.product.short_name }} in noninteractive debug mode for \<seconds\>, and
     automatically exit debug mode after the specified number of seconds.
 
-### Examples
+### EXAMPLES:
 
 ```bash
 syslog-ng-debun -r
@@ -202,7 +188,7 @@ Collect pcap and debug mode output following this scenario:
 
 - Stop packet capturing
 
-## Files
+## FILES
 
 /opt/syslog-ng/bin/loggen
 
diff --git a/doc/_admin-guide/190_The_syslog-ng_manual_pages/009_slogencrypt_manual.md b/doc/_admin-guide/190_The_syslog-ng_manual_pages/009_slogencrypt_manual.md
index db0faca..3e5aff5 100644
--- a/doc/_admin-guide/190_The_syslog-ng_manual_pages/009_slogencrypt_manual.md
+++ b/doc/_admin-guide/190_The_syslog-ng_manual_pages/009_slogencrypt_manual.md
@@ -13,65 +13,57 @@ description: >-
     slogencrypt --- Encrypts existing plain text log files using the {{ site.product.short_name }} secure logging environment.
 ---
 
-## Synopsis
+## SYNOPSIS
 
 ```
 slogencrypt [options] [arguments]
 ```
 
-## Description
+## DESCRIPTION
 
 The `slogencrypt` utility encrypts plain text log files using an existing secure logging environment. Using this utility, log files obtained from a previous installation of {{ site.product.short_name }} or another logging system can be transferred to a secure logging environment. The order of the log entries is preserved. Encrypting plain text log files using an existing secure logging environment, requires the current encryption key to be supplied in order to preserve consistency.
 
-### Example: a general call sequence
+### EXAMPLE: A GENERAL CALL SEQUENCE
 
 ```
 slogencrypt -k <key file> -m <MAC file> <new key file> <new MAC file> <plain text log> <output file> [counter]
 ```
 
-## Arguments
-
-* `<new key file>`
+## ARGUMENTS
 
+`<new key file>`
     The file that containa the new encryption key after successful encryption.
 
-* `<new MAC file>`
-
+`<new MAC file>`
     The file receiving the new message authentication code (MAC) of the secure encrypted destination after encryption. In case an existing file is supplied, new entries are appended.
 
-* `<input log file>`
-
+`<input log file>`
     The plain text log file that is encrypted using the secure logging environment.
 
-* `<output log file>`
-
+`<output log file>`
     The file that contains the encrypted log entries from the supplied plain text log file after encryption.
 
-* `counter`
-
+`counter`
     The current log entry counter of the secure encrypted destination after encryption. This is required if the log entries to be encrypted are appended to an existing secure encrypted destination
 
-## Options
-
-* --key-file or -k
+## OPTIONS
 
+`--key-file` or `-k`
     The current host key from the system where the encryption is performed.
 
-* --mac-file or -m
-
+`--mac-file` or `-m`
     The current MAC file from the system where the encryption is performed.
 
-* --help or -h
-
+`--help` or `-h`
     Display a help message.
 
-## Files
+## FILES
 
-`/usr/bin/slogencrypt`
+/opt/syslog-ng/bin/slogencrypt
 
-`/etc/syslog-ng.conf`
+/opt/syslog-ng/etc/syslog-ng.conf
 
-## Additional Information
+## SEE ALSO
 
 * The syslog-ng.conf manual page
 * The {{ site.product.short_name }} manual page
diff --git a/doc/_admin-guide/190_The_syslog-ng_manual_pages/010_slogkey_manual.md b/doc/_admin-guide/190_The_syslog-ng_manual_pages/010_slogkey_manual.md
index a8aec76..605e520 100644
--- a/doc/_admin-guide/190_The_syslog-ng_manual_pages/010_slogkey_manual.md
+++ b/doc/_admin-guide/190_The_syslog-ng_manual_pages/010_slogkey_manual.md
@@ -13,17 +13,15 @@ description: >-
     slogkey --- Manages the cryptographic keys for use with the {{ site.product.short_name }} secure logging environment.
 ---
 
-## Synopsis
+## SYNOPSIS
 
-```
 slogkey [options] [arguments]
-```
 
-## Description
+## DESCRIPTION
 
 The `slogkey` utility is used to manage cryptographic keys for use with the secure logging module of {{ site.product.short_name }}. Use this utility to create a master key, derive a host key to be used by a secure logging configuration and to display the current sequence counter of a key. The options determine the operating mode and are mutually exclusive.
 
-## Arguments
+## ARGUMENTS
 
 The arguments depend on the operating mode.
 
@@ -47,29 +45,27 @@ The arguments depend on the operating mode.
 
   * Sequence counter display
 
+## OPTIONS
 
-## Options
-
-* `--master-key` or `-m`
-
+`--master-key` or `-m`
     Generates a mew master key. `<filename>` is the name of the file storing the newly generated master key.
-* `--derive-key` or `-d`
 
+`--derive-key` or `-d`
     Derive a host key using a previously generated master key.
-* `--counter` or `-c`
 
+`--counter` or `-c`
     Display the current log sequence counter of a key.
-* `--help` or `-h`
 
+`--help` or `-h`
     Display a help message.
 
-## Files
+## FILES
 
-`/usr/bin/slogkey`
+/opt/syslog-ng/bin/slogkey
 
-`/etc/syslog-ng.conf`
+/opt/syslog-ng/etc/syslog-ng.conf
 
-## Additional Information
+## SEE ALSO
 
 * The syslog-ng.conf manual page
 * The secure-logging manual page 
\ No newline at end of file
diff --git a/doc/_admin-guide/190_The_syslog-ng_manual_pages/011_slogverify_manual.md b/doc/_admin-guide/190_The_syslog-ng_manual_pages/011_slogverify_manual.md
index 24200f1..6975597 100644
--- a/doc/_admin-guide/190_The_syslog-ng_manual_pages/011_slogverify_manual.md
+++ b/doc/_admin-guide/190_The_syslog-ng_manual_pages/011_slogverify_manual.md
@@ -13,22 +13,21 @@ description: >-
     slogverify --- Verifies cryptographically secured logs.
 ---
 
-## Synopsis
+## SYNOPSIS
 
-```
 slogverify [options] [arguments]
-```
 
-## Description
+## DESCRIPTION
 
 The slogverify utility is used to verify the integrity of cryptographically secured logs and to decrypt log entries produced in a {{ site.product.short_name }} secure logging environment.
 
-* Normal mode:
+Normal mode:
     `slogverify -k <host key file> -m <input MAC file> <input file> <output file> [buffers]`
-* Iterative mode:
+    
+Iterative mode:
     `slogverify -i -p <previous host key> -r <previous MAC> -m <current MAC> <input file> <output file> [buffers]`
 
-## Arguments
+## ARGUMENTS
 
 * input file
 
@@ -40,39 +39,33 @@ The slogverify utility is used to verify the integrity of cryptographically secu
 
     Optional number of input buffers. The number of buffers can be used for performance adjustments in case the log file to be verified is very large and cannot be processed at once. It is a positive number of log entries that can be held in memory during verification. The minimum number if 10 and the maximum number is 4294967295. If this argument is not supplied the default of 1000 is used.
 
-## Options
-
-* `--iterative` or `-i`
+## OPTIONS
 
+`--iterative` or `-i`
     Iterative mode. This is useful in case the log files are periodically copied from the system on which they where generated to central collector. As log rotation, i.e. overwriting log files in order to preserve space cannot be done in a secure logging environment, the iterative mode can be used instead. This works as follows: If a certain storage limit is reached the log file together with the host key and the MAC file is copied to new destination and the old file is deleted. The verification is then performed in iterations, i.e. separately for each file that was retrieved from the log host. For this to work, it is important to always retrieve the corresponding host key and MAC files. The process can be automated, for example by calling slogverify in iterative mode from a script.
 
-* `--key-file` or `-k`
-
+`--key-file` or `-k`
     The initial host key (`k0`). This option is used in normal mode only.
 
-* `--mac-file` or `-m`
-
+`--mac-file` or `-m`
     The current MAC file used.
 
-* `--prev-key-file` or `-p`
-
+`--prev-key-file` or `-p`
     The host key corresponding to the previous log file. This option can be used in iterative mode only. In theory, this can be initial host key (`k0`) but using this key might generate warnings, as the gap between the first log entry ever (log entry 0) and the first log entry of the current log file might be large.
 
-* `--prev-mac-file` or `-r`
-
+`--prev-mac-file` or `-r`
     The MAC file from the previous log file. This option can only be used in iterative mode.
 
-* `--help` or `-h`
-
+`--help` or `-h`
     Display a help message.
 
-## Files
+## FILES
 
-`/usr/bin/slogverify`
+/opt/syslog-ng/bin/slogverify
 
-`/etc/syslog-ng.conf`
+/opt/syslog-ng/etc/syslog-ng.conf
 
-## Additional Information
+## SEE ALSO
 
 * The syslog-ng.conf manual page
 * The secure-logging manual page 
\ No newline at end of file
diff --git a/doc/_admin-guide/190_The_syslog-ng_manual_pages/012_secure_logging_manual.md b/doc/_admin-guide/190_The_syslog-ng_manual_pages/012_secure_logging_manual.md
index 9ae721c..966b68f 100644
--- a/doc/_admin-guide/190_The_syslog-ng_manual_pages/012_secure_logging_manual.md
+++ b/doc/_admin-guide/190_The_syslog-ng_manual_pages/012_secure_logging_manual.md
@@ -13,13 +13,13 @@ description: >-
     secure-logging --- Provides forward integrity and confidentiality for system logs.
 ---
 
-## Synopsis
+## SYNOPSIS
 
 ```config
 $(slog --key-file <host key file> --mac-file <MAC file> ${RAWMSG})
 ```
 
-## Description
+## DESCRIPTION
 
 Secure logging is an extension of {{ site.product.short_name }} which provides system log forward integrity and confidentiality. It is implemented in form of a module and is configured as a template in the {{ site.product.short_name }} configuration file.
 
@@ -55,6 +55,7 @@ AAAAAAAAAAA=:k3/dYpLsgO2tUJKSauo6dycIBzW6OTC3pyA9TP+7AnqFgEojBzgC2rcK4OPfRtr8yg=
 AQAAAAAAAAA=:smw0ATISVgN+BYEu5d7OLBE7aQhHpK9Ro4MndmNgSVrqhcmRCBCj6DUnD6ku0Z29CKJ0N6LAJUgByX4Ev+g=
 AgAAAAAAAAA=:5UVybnKL1EAbgC4CLfd8HpgurjREf4LEN61/yWHSD2hbXjRD4QmQdtbwguT1chzdItKSQASps9QRIvR5Jd4AHzHfqxI4aRgdUBcNbAq26nwUCg5vPWygjmbtQaxZgCJYkry8slxCigmbTVs=
 ```
+
 The following is the output of a successful verification run:
 
 ```
@@ -62,20 +63,22 @@ The following is the output of a successful verification run:
 0000000000000001: And here comes another log message
 0000000000000002: This is a log message with a longer text that is processed without any problems
 ```
+
 The original log messages have been successfully restored, and the sequence counters are also assigned to the clear text messages. This helps in analyzing problems within a particular log entry. As real log files will contain thousands of entries. The sequence counter helps to identify faulty entries.
 
 Before the secure logging module can be used as part of an existing {{ site.product.short_name }} installation, several preparatory activities are necessary.
 
-## Key Generation
+## KEY GENERATION
 
 To bootstrap the system, an initial key (`k0`) must be created and installed on the log host before secure logging environment is started for the first time.
 
 The initially created host key (`k0`) has its counter set to `0` marking it as the initial host key. This host key must be kept secret and it cannot be disclosed to third any parties. It is required to successfully decrypt and verify log archives processed by the secure logging environment. As each log entry is encrypted with its own key, a new host key will be created after successful processing of a log entry and replaces the previous key. Therefore, the initial host key needs to be stored in a safe place before starting the secure logging environment, as it is deleted from the log host after processing of the first log entry. The following steps must be done before starting the secure logging environment. Steps 1 and 2 are performed with the slogkey utility. See the slogkey.1 manual page for details on how to generate a master key and to derive a host key from it. Step 3 and 4 depend on the actual deployment in a target environment.
+
 1. Create a master key.
 2. Derive an initial host key (`k0`) from the master key (`key1`). Store the `k0` key in a safe location that is outside of the log host.
 3. Deploy `k0` on the log host, where the secure logging module is to be used.
 
-## Configuration
+## CONFIGURATION
 
 Secure logging can be configured by adding corresponding statements to the `syslog-ng.conf` file.
 
@@ -88,24 +91,20 @@ template("$(slog --key-file  <host key file> --mac-file <MAC file> ${RAWMSG})\n"
 ```
 
 The purpose of the elements within the statement:
-* `slog`
 
+`slog`
     The name of the secure logging template function. This name can be also be found by calling {{ site.product.short_name }} with the `--module-registry` arguments and checking the `template-func` property of the secure logging module in the corresponding output.
 
-* `--key-file` or `-k`
-
+`--key-file` or `-k`
     The host key file. `<host key file>` is the full path of the file storing the host key on the log host. If this arguments is not supplied or does not point to a valid key file, {{ site.product.short_name }} does not start and a displays an error message.
 
-* `--mac-file` or `-m`
-
+`--mac-file` or `-m`
     The MAC file. `<MAC file>` is the full path of the MAC file on the log host. The file is automatically created upon the initial start. If the path is not correct, {{ site.product.short_name }} does not start and a displays a corresponding error message.
 
-* `${RAWMSG}`
-
+`${RAWMSG}`
     `${RAWMSG}` provides access to the original log message received at the source. This macro is only available if the store-raw-message flag was set for the source. Otherwise, an empty string is passed to the secure logging template. If access to the original message is not available, for example, if the source does not support the `store-raw-message` flag, then the `${MSG}` macro can also be used. In this case, however, the integrity guarantee provided by secure logging is limited to the content that this macro provides and does not protect the complete original message.
 
-* `\n`
-
+`\n`
     `\n` is a line separator and its use is important, as the secure logging template expects log entries to be separated. When detecting a line separator, the log entry is regarded as complete and is encrypted with the current host key. Therefore, only a single line separator is allowed.
 
 The secure logging template can be combined with any source or destination with the following limitations:
@@ -114,7 +113,7 @@ The secure logging template can be combined with any source or destination with
 * Only sources for which the store-raw-message flag is implemented and set do benefit from the integrity guarantee provided by the secure logging template. Secure logging aims at protecting the integrity of complete log messages including all associated meta-data, such as timestamps and host names. {{ site.product.short_name }} parses the log message into its internal format and provide easy access to parts of a message through macros. While this is convenient when rewriting log messages, it is not helpful for secure logging. {{ site.product.short_name }} provides the store-raw-message flag which provides access to a copy of the original log message after parsing. This is the log message processed and protected by the secure logging template. If the source does not support the `store-raw-message flag`, then the `${MSG}` macro can also be used. However, in this case the integrity guarantee provided by secure logging is limited to the content that this macro provides.
 * Log rotation of any kind cannot be used with destinations using secure logging, because log rotate overwrites or deletes previous log files. This compromises the cryptographic chain of trust of the log entries preve recovery. To efficiently handle log files, the secure logging environment features iterative verification. Using iterative verification, a log file can be verified in steps. For this to work, the log file must first be downloaded from the log host, together with the corresponding host key and MAC file to a verification host. After downloading, the log file can be safely deleted from the log host. Verification is then performed on the verification host using the iterative mode of the slogverify utility.
 
-### Example: secure logging template on a file destination
+### EXAMPLE: SECURE LOGGING TEMPLATE ON A FILE DESTINATION
 
 ```config
 #############################################
@@ -159,11 +158,11 @@ log {
 };
 ```
 
-## Log verification
+## LOG VERIFICATION
 
 To analyze the log file created in a secure logging environment, the log files must be decrypted and their integrity be verified. Verification requires both the initial host key (`k0`) and the corresponding MAC file and is performed with the slogverify utility. It is not normally performed on the log host where the secure logging environment is producing log data. In a typical deployment, log files would be retrieved from the log host and transferred to a central log collector where verification it performed. As verification requires the use of  `k0`, it should only be performed in a trusted environment.
 
-### Normal mode
+### NORMAL MODE
 
 In normal mode, a complete log archive is verified at once. In a typical environment, this would mean retrieving a log file together with is MAC file from a log host and retrieving the corresponding initial key `k0` from a safe location and supplying them to the slogverify utility. A typical call sqeuence for normal mode is presented in the following example:
 
@@ -173,20 +172,16 @@ slogverify --key-file host0.key --mac-file mac.dat /var/log/messages.slog /var/l
 
 The purpose of the elements within the statement:
 
-* `host0.key`
-
+`host0.key`
     The initial host key (`k0`). Supplying `k0` is enough for decrypting all log entries, as the key derivation algorithm is able to generate the necessary keys for all subsequent log entries based on `k0`.
 
-* `mac.dat`
-
+`mac.dat`
     The MAC file from the log host.
 
-* `/var/log/messages.slog`
-
+`/var/log/messages.slog`
     The file containing the encrypted log entries as retrieved from a log host.
 
-* `/var/log/verified/messages`
-
+`/var/log/verified/messages`
     The file receiving the plain text log after decryption.
 
 Log files may become too large and not fit into the system memory. Verification is therefore performed in chunks. Each part of the log file is transferred to an internal buffer on which verification is performed. After the buffer has been processed, the next chunk is fetched. An optional buffer argument can be supplied to the slogverify utility in order to change the default buffer size of 1000 log entries to a number suitable for the system on which the verification is performed, for example:
@@ -197,7 +192,7 @@ slogverify --key-file host.key --mac-file mac.dat /var/log/messages.slog /var/lo
 
 For more information on verification in normal mode, [[slogverify|adm-man-slogkey]].
 
-### Iterative mode
+### ITERATIVE MODE
 
 Verification in normal mode may not be suitable for some application scenarios. Many log hosts use log rotation in order to preserve storage space. In log rotation, a threshold for the maximum amount of storage space and the number of generations is defined for different type of log files. When either storage space is exhausted or the number of generations is reached, the oldest log file is overwritten by new incoming log data. This procedure is not possible in secure logging environment, as overwriting, i.e. deleting a log file would break the cryptographic chain that is established between the log entries. This comes as no surprise, as one of the main objectives of secure logging is to protect against deletion of log entries by a potential attacker.
 
@@ -218,39 +213,39 @@ slogverify --iterative --prev-key-file host.key.2 --prev-mac-file mac.dat.2 --ma
 
 The purpose of the elements within the statement:
 
-* `host.key.2`
+`host.key.2`
 
     The host key from the previous iteration. In this example, this is the second iteration.
 
-* `mac.dat.2`
+`mac.dat.2`
 
     The MAC file from the previous iteration. In the example, verification is performed during the third iteration, so the MAC file from the second iteration is required.
 
-* `mac.dat`
+`mac.dat`
 
     The current MAC file from the log host.
 
-* `/var/log/messages.slog.3`
+`/var/log/messages.slog.3`
 
     The file element containing the encrypted log entries as retrieved from the log host during the third iteration.
 
-* `/var/log/verified/messages.3`
+`/var/log/verified/messages.3`
 
     The file receiving the plain text log after decryption during the third iteration.
 
 In a real deployment, the above steps would typically be automated using a scripting engine. See [[slogverify|adm-man-slogver]] for details on verification in iterative mode.
 
-## Files
+## FILES
 
-`/usr/bin/slogkey`
+/opt/syslog-ng/bin/slogkey
 
-`/usr/bin/slogencrypt`
+/opt/syslog-ng/bin/slogencrypt
 
-`/usr/bin/slogverify`
+/opt/syslog-ng/bin/slogverify
 
-`/etc/syslog-ng.conf`
+/opt/syslog-ng/etc/syslog-ng.conf
 
-## Additional Information
+## SEE ALSO
 
 * The syslog-ng.conf manual page
 * The slogkey manual page