#ntp
:programname, isequal, "ntpd"            /var/log/ntp.log
& stop

