filter f_abnormal_access {
    level(warn..emerg);
    match("AbnormalAccess:" value("MESSAGE"));
};

rewrite r_rewrite_abnormal_access {
    subst("AbnormalAccess:", "");
};

destination d_abnormal_access { file("/var/lib/diskutil/abnormal_access.log"); };
log { source(src); filter(f_abnormal_access); rewrite(r_rewrite_abnormal_access); destination(d_abnormal_access); };