Q:

Setup for rsyslog to log from two network devices

I have 2 VOIP devices on my network (ht502 and ht704) which are both capable of sending their log info as syslog data. Receiver is a little Raspberry on Raspbian.
I wanted to configure syslog to receive messages from both VOIP devices and store them into their respective (different) log files. So far I failed to accomplish that.
I enabled syslog (by uncommenting the below lines in /etc/rsyslog.conf):
$ModLoad imudp
$UDPServerRun 514
$ModLoad imtcp
$InputTCPServerRun 514

I created two files in /etc/rsyslog.d/ as follows.
ht704.conf
$template NetworkLog, "/var/log/ht704.log"
:fromhost-ip, isequal, "192.168.11.160" -?NetworkLog

ht502.conf
$template NetworkLog, "/var/log/ht502.log"
:fromhost-ip, isequal, "192.168.11.162" -?NetworkLog

Note the respective different IP addresses.
And restarted the serice:
service rsyslog restart

It turns out however that all output lands in the /var/log/ht502.log file.
Example:
Nov  7 19:05:39 HT-502 [00: 0B:82:42:31:62]: [1.0.14.1] NAT::checkNAT: detected NAT environment for account 1
Nov  7 19:05:39 HT-502 [00: 0B:82:42:31:62]: [1.0.14.1] NAT::addPortMapping(STUN), iport = 49260
Nov  7 19:05:39 HT704 [00: 0B:82:65:DD:1C] [1.0.5.10]:System uptime: 1846
Nov  7 19:05:39 HT704 [00: 0B:82:65:DD:1C] [1.0.5.10]:System memory: 13213696/724992/0/794624
Nov  7 19:05:40 HT-502 [00: 0B:82:42:31:62]: [1.0.14.1] SIPClientTransaction::sendRequest: Request 15 is sent
Nov  7 19:05:40 HT-502 [00: 0B:82:42:31:62]: [1.0.14.1] SIPStack(0)::run: Active transactions: 2

On top of all I actually just noticed that the messages from the VOIP devices also unexpectedly showed up in /var/log/messages and /var/log/syslog. I don't think they should show up there. Or should they?
Any idea what's missing?

A:

TL;DR :
Your templates are clobbering each other(although they do not seem to be inherited by other .conf files, they are conflicting - your guess is as good as mine).
Rename NetworkLog to a unique name per file.
Add & ~ as the last line in ht704.conf and ht502.conf
Alternative(cleaner):
create a single .conf file in /etc/rsyslog.d/ containing the following:

:fromhost-ip, isequal, "192.168.11.160" /var/log/ht704.log
& ~
:fromhost-ip, isequal, "192.168.11.162" /var/log/ht502.log
& ~

with formatters example:
$template RFC3164fmt,"<%PRI%>%TIMESTAMP% %HOSTNAME% %syslogtag%%msg%"
:fromhost-ip, isequal, "192.168.11.160" /var/log/ht704.log;RFC3164fmt
:fromhost-ip, isequal, "192.168.11.162" /var/log/ht502.log;RFC3164fmt
& ~

Long Version :
I recently found myself struggling to understand the precedence and syntax of these files and and found this question while googling. I would like to link to the documentation but I found it terribly hard to parse and it seems there is already an incentive to improve it underway here:  https://github.com/rsyslog/rsyslog-doc
As a result, most of the advice comes from empirical evidence(things I tried).
image - help for rsyslog docs
TIL:
The FILENAMEs in /etc/rsyslog.d are operated on with alphabetical precedence[collation dependent](i.e. why the default is named 50-default.conf).  As an example I was trying to have multiple output files with different formatting based on the same rule/condition ( :fromhost-ip, etc. ); the answer was to have the first file read(alphabetically/collationally) do whatever and exclude the  STOP (& ~) while presenting a different output to the second file(alphabetically/collationally) AND **including the STOP (& ~) .
The first file in this example was named 10-ddwrt.conf and the second was named 15-ddwrt.conf.
Hope this helps and please feel free to improve upon it.  I specifically did not get into the "new" syntax as it is incompatible with older version of rsyslog.

