$FileCreateMode 0640 $FileOwner root $FileGroup adm if $syslogfacility-text == 'mail' then /var/log/mail.log & stop