diverting (some) log_in_vain messages

[Ian Smith]

Hi, I'll try reducing and rephrasing my question/s ..

Which syslog facility.level is used for {tcp,udp}.log_in_vain messages?

*.notice;authpriv.none;kern.debug;mail.crit;news.err;ntp.err;local0.none;ftp.none  /var/log/messages

[..]

I'd like to parse out just the log_in_vain messages, dumping what in my 
circumstances is log-spamming trivia to another file, while allowing the 
unexpected, more interesting stuff to get to /var/log/messages as usual
- or to another file if it's a problem appending /var/log/messages from 
syslog output piped to (say) a sh script, as well as directly as above.

Any hints or howtos welcome, even RT(which?)FS, though I'm short of code 
reading time, what with all the dragons ..

cheers, Ian