How To Separate Each Of Syslog Client’s Messages Into Different File (CentOS/RHEL 6 and 7)

The below post explains steps to divert syslog to different files for each client.

1. Open and edit /etc/rsyslog.conf, then add below lines:

$template FILENAME,"/var/log/%fromhost-ip%/messages"
*.* ?FILENAME

2. Restart rsyslog service to take effect:

# systemctl restart rsyslog.service

# service rsyslog restart

3. Each of client’s messages will be generated dynamically depending on client’s IP address, for example:

/var/log/192.168.1.2/messages