# log arpwatch in a separate file
if $programname == 'arpwatch' then /var/log/arpwatch.log