    When using bf(rsyslogd)(1) property based filters may be used to filter
syslog messages and write them to a file of your choice. E.g., to filter
messages starting with the syslog message tag (e.g., tt(STEALTH)) use
        verb(
:syslogtag, isequal, "STEALTH:"   /var/log/stealth.log
:syslogtag, isequal, "STEALTH:"   stop
        )
    Note that the colon is part of the tag, but is not specified with the 
tt(syslog-tag) option.

    This causes all messages having the tt(STEALTH:) tag to be written on
tt(/var/log/stealth.log) after which they are discarded. More extensive
filtering is also supported, see, e.g.,
tt(http://www.rsyslog.com/doc/rsyslog_conf_filter.html) and
tt(http://www.rsyslog.com/doc/property_replacer.html)

Time stamps written by tt(rsyslogd) are not controlled by s()'s
tt(--time-stamp) option, but, e.g., by a tt(TZ) specification in
tt(/etc/default/rsyslog). Simply add the line
    verb(    export TZ=UTC)
 to tt(/etc/default/rsyslog), followed by restarting tt(rsyslogd) configures
tt(rsyslogd) to generate time stamps using UTC.
