:msg, contains, "dh-syn-flood" -/var/log/synflood.log
& ~