$PreserveFQDN on $RepeatedMsgReduction off $template CustomHist,"%$now% %TIMESTAMP:12:19:date-rfc3339% %HOSTNAME% %syslogtag%%msg:::drop-last-lf%\n" local4.alert -/var/log/nc_audit/history;CustomHist local6.notice -/var/log/nc_audit/remote_commands;CustomHist local4.alert stop local6.notice stop if $programname == 'drupal' and $syslogseverity <= '6' then stop