destination d_sysnotify { file("/var/log/sysnotify.log"); };

filter f_sysnotify { match("SYSNOTIFY:" value("MESSAGE")); };

log { source(src); filter(f_sysnotify); destination(d_sysnotify); };