Usually you can filter for a facility by a facility name. In the case of authpriv which I want to describe now, this is fairly easy: authpriv.* /var/log/authprivlog That will work just fine with rsyslog on any common Linux system. But, when using Solaris, some things work similar and some work different. In the case […]