1# redirect com.apple.eventmonitor* messages to /var/log/eventmonitor
2? [A= Facility com.apple.eventmonitor] claim only
3* store_dir /var/log/eventmonitor
4