This works for splitting off lmtp traffic, for instance. syslog_facility = uucp
rsyslog:
:msg, contains, "lmtp(" -/var/log/dovecot/lmtp.log
& stop
uucp.=debug -/var/log/dovecot/debug.log
uucp.=info -/var/log/dovecot/dovecot.log
uucp.=warn -/var/log/dovecot/warn.log
uucp.=err -/var/log/dovecot/error.log
uucp.=crit -/var/log/warn.log
plus:
auth,authpriv,cron,daemon,mail,uucp,news.none -/var/log/syslog
(whatever you don't want to see in syslog)
Kai
