LOGFILE=/var/log/messages 

shorewall.* /var/log/shorewall

rsyslogd-3000: unknown facility name "shorewall" [try http://www.rsyslog.com/e/3000 ]
rsyslogd: the last error occured in /etc/rsyslog.conf, line 40:"shorewall.*                                               /var/log/shorewall"
rsyslogd: warning: selector line without actions will be discarded

:msg, contains, "Shorewall:" /var/log/shorewall 
& ~