rlisten.conf

# Auditd logging
# Log linux audit log on original format:
$template Audit_log, "/var/log/hosts/%$year%/%$month%/%$day%/%fromhost-ip%/audit.log"
$template auditFormat, "%msg%\n"
:programname,   isequal,        "audispd"       -?Audit_log;auditFormat
& ~

:programname,   isequal,        "audispd"       ~
& ~

$template Auth_log,"/var/log/hosts/%$year%/%$month%/%$day%/%fromhost-ip%/auth.log"
$template Kern_log,"/var/log/hosts/%$year%/%$month%/%$day%/%fromhost-ip%/kern.log"
$template Mail_log,"/var/log/hosts/%$year%/%$month%/%$day%/%fromhost-ip%/mail.log"
$template Info_log,"/var/log/hosts/%$year%/%$month%/%$day%/%fromhost-ip%/info.log"
$template Misc_log,"/var/log/hosts/%$year%/%$month%/%$day%/%fromhost-ip%/misc.log"

auth,authpriv.*     -?Auth_log
& ~

kern.*              -?Kern_log
& ~

mail.*              -?Mail_log
& ~

*.info              -?Info_log
& ~

*.*									-?Misc_log
& ~