
:msg, startswith, " sys-admin"			-/var/log/sys-admin.log
:syslogtag, startswith, "sys-admin"		-/var/log/sys-admin.log
