filter f_certmon { facility(local6) and program(cert-mon); };
destination d_certmon { file("/var/log/cert-mon.log"); };
log { source(s_src); filter(f_certmon); destination(d_certmon); };