Add at the beginning of /etc/rsyslog.d/50-default.conf:
1 2 3 | $template PerHostLog,"/var/log/filename.log"if $fromhost-ip != ’127.0.0.1′ then -?PerHostLog& ~ |
Uncomment the lines in /etc/rsyslog.conf:
1 2 3 4 | $ModLoad imudp$UDPServerRun 514$ModLoad imtcp$InputTCPServerRun 514 |
Restart the service
1 | sudo service rsyslog restart |
Don’t forget to tune the permissions:
1 | sudo chown syslog:syslog /var/log |