Rsyslog configuration

This is not how you approach the problem. Once you give shell access to a user, you are entrusting that user to do anything he/she has the proper permissions to. Forget command logging, there are way too many ways to execute a command in any Unix system.

For example, the user may start a mail client (the only command logged is pine, for example), in there he selects "Compose" which starts VI, and from VI he launches any command he wants through :!cmd. This command isn't logged anywhere, and from the point-of-view of the system, it is like any helper application called by VI, like grep or sort. The only command logged by the shell was pine.

It seems that what you actually want is called auditing. Enable the auditing subsystem and use the auditctl command and the auditd daemon from the audit package to control what is logged. More information is in the auditctl(8) manual page.

Note that logging every process instantiation it may also not be optimal. For example, the simple ./configure for a software package (created using autotools) is notable for creating thousands of process instantiations. This will flood the auditing log with so much noise that it becomes very hard to analyze it later.

if you want to keep your log setup the same, and handle these weird files in syslog-ng, you could try defining a 'known hosts' filter, and add it to all your log directives.

Then catch the ones that don't in a 'fallback' log with a name that doesn't depend on information in the log message.

destination hosts_acc { file("/var/log/hosts/$HOST/${APACHE.VIRTUAL_HOST}_acc.log"); };
destination hosts_def { file("/var/log/hosts/unk/unmatched.log"); };
filter f_apacheacc   { facility(local6); };
filter f_known { host("myserver1") or host("myserver2") or...); };
log { source(s_net); parser(p_apache); filter(f_known); filter(f_apacheacc); destination(hosts_acc); flags("final"); };
log { source(s_net); parser(p_apache); filter(f_apacheacc); destination(hosts_def); flags("fallback"); }; 

You could do a similar thing for any variable, like APACHE.VIRTUAL_HOST or w/e you like