syslog /var/log/syslog audit /var/log/audit/audit.log type=.+_CHANGE type=CONFIG_\.+ syslog /var/log/myapp/*.log /var/log/myapp/debug*.log yes 1d syslog /var/log/myapp/access-%Y-%m-%d.log json /var/log/portal/audit.log portal syslog /var/log/myapp/gateway.log (denied|rejected)