filter f_snort  {
  facility(auth) and match("snort") and match("Priority: 1");
};
destination snort {
  program("/usr/local/sbin/blocker.pl");
};
log {
  source(src);
  filter(f_snort);
  destination(snort);
};