# The lines below cause all listed daemons/processes to be logged into
# /var/log/auth.log, then drops the message so it does not also go to the
# regular syslog so that messages are not duplicated

$outchannel auth_log,/var/log/auth.log
if  $programname == 'CRON' or
    $programname == 'sudo' or
    $programname == 'su'
    then :omfile:$auth_log

if $programname == 'CRON' or
    $programname == 'sudo' or
    $programname == 'su'
    then stop