:msg,contains,"[UFW " /var/log/ufw.log
& ~
