SuSE

destination dhcplog { file("/var/log/dhcpd.log"); };
filter f_dhcpd { level(info) and match("dhcpd"); };
log { source(src); filter(f_dhcpd); destination(dhcplog);};
 
destination messages { file("/var/log/messages"); };
filter f_messages {
        level(info..warn)
        and not facility(auth, authpriv, mail, news)
        and not match ("apache")
        and not match ("dhcpd")
        and not match ("sshd")
};
log { source(src); filter(f_messages); destination(messages);};