input	/proc/kmsg
log	kernel
run	socklog ucspi