
#proftpd
if $programname == 'proftpd' and $syslogfacility-text == 'authpriv' then      /var/log/secure
:programname, isequal, "proftpd"            /var/log/proftpd/proftpd.log
& stop

