How do I configure rsyslog to write to /var/log/{hostname of sender} when receiving remote logs?

Question

My ADSL modem supports remote logging via syslog. I have set up my server, running rsyslog, to accept the log messages from the modem and they are being show in /var/log/syslog along with the messages generated on the server. The log looks like this:

(timestamp) (hostname) (program): (message)

Where hostname is either server or modem.

I've look over the (terrible, IMO) documentation, and found this example that looks like what I need, but I can't make it work in my situation.

How do I configure rsyslog to write the logs received from the modem to /var/log/modem instead of /var/log/syslog?

The modem IP is static, if that helps to simplify the answer.

Moderators: This post should probably have a rsyslog tag instead of syslog, but my reputation isn't high enough to create it.

• Janos Pasztor: If you are looking for a better documented and easier to configure syslog daemon, why not give syslog-ng a spin? The official documentation is unrivaled in quality and the software itself works like a charm too.
• x-x: @Janoszen, Thank you for the suggestion. I wasn't looking for a replacement, but lack of answers here may force a change. I presume it should be as easy as apt-get remove rsyslog && apt-get install syslog-ng?
• Janos Pasztor: actually it's just apt-get install syslog-ng. It will automatically remove rsyslog if I know correctly.

Answer 1

Using a simple template to create one file for each host:

$template DynaFile,"/var/log/%HOSTNAME%"
*.* -?DynaFile

Source: How to separate log files by host name of sending device?

I'm not sure if the right property to use in this case is 'hostname', 'source' or 'fromhost', but from my understanding of the properties documentation any of them will work in your case.

Answer 2

If you are using rsyslog then use a $template remote-incoming-logs declaration in /etc/rsyslog.conf

$template remote-incoming-logs,"/var/log/%HOSTNAME%/%PROGRAMNAME%.log"
*.* ?remote-incoming-logs

In case of your example, a login on host modem would send the log message to file /var/log/modem/auth.log.

Taken from this article.