$PreserveFQDN on
$RepeatedMsgReduction off
$template CustomHist,"%$now% %TIMESTAMP:12:19:date-rfc3339% %HOSTNAME% %syslogtag%%msg:::drop-last-lf%\n"
local4.alert   -/var/log/nc_audit/history;CustomHist
local6.notice  -/var/log/nc_audit/remote_commands;CustomHist
local4.alert   stop
local6.notice  stop
if $programname == 'drupal' and $syslogseverity <= '6' then stop