diverting (some) log_in_vain messages

[Ian Smith]

Which syslog facility.level is used for {tcp,udp}.log_in_vain messages?

I want to see these as a rule, especially now while tuning a new system 
and firewall, but since running sendmail in earnest (even on our small 
scale) there are times when poor old /var/log/messages is rapidly losing 
much utility, being spammed by a) local resolver retries (lame servers 
and such) and b) connection attempts beyond sendmail's (low) set limits.

These have been very useful for tuning the sendmail timeouts for a small 
server to drastically reduce these, but I've seen enough for now ..

So I'd like to parse just log_in_vain messages, dumping the trivia to 
another file yet allowing the unexpected, more interesting stuff to go 
to /var/log/messages as usual, or to another file if that's a problem.

Any hints or howtos welcome, even RT(which?)FS ..

cheers, Ian  (please cc me, I'm only subscribed to the -digest)