$FileCreateMode 0640 $FileOwner root $FileGroup adm if $fromhost-ip startswith '172.30.' and not $msg contains 'regdmn5g' then /var/log/net.log & stop
