if $programname == 'RASCSI' then /var/log/rascsi.log & stop