filter f_auth { facility(auth) and level(warn..emerg); };
filter f_authpriv { facility(authpriv); };
destination d_auth { file("/var/log/auth.log" owner("root") group("log") perm(0640)); };
log { source(src); filter(f_auth); destination(d_auth); };
log { source(src); filter(f_authpriv); destination(d_auth); };