Sloved it… just added the following to the /etc/rsyslog.d/50-default.conf
:msg, contains, "ampinstmgr" stop
:msg, contains, "ampfirewall" stop
:msg, contains, "amptasks" stop
:msg, contains, "AMP" stop
before
auth,authpriv.* /var/log/auth.log