[ssh]
enabled     = true
filter      = sshd
action      = route
logpath     = /var/log/auth.log