[prometeusz]

Juz znalazlem
filter f_secure { facility(auth, authpriv); };
destination d_secure { file("/var/log/secure" fsync(no)); };
log { source(src); filter(f_secure); destination(d_secure); };