Red Hat

# ... module loading ...
# process remote messages
:fromhost-ip, isequal, "10.0.1.105"    /var/log/client-10.0.1.105
& ~

# yum list | grep rsyslog
rsyslog.x86_64                           3.22.1-3.el5_6.1              base
rsyslog-gnutls.x86_64                    3.22.1-3.el5_6.1              base
rsyslog-gssapi.x86_64                    3.22.1-3.el5_6.1              base
rsyslog-mysql.x86_64                     3.22.1-3.el5_6.1              base
rsyslog-pgsql.x86_64 
#

# more /etc/rsyslog.conf
# Use traditional timestamp format
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

# Provides kernel logging support (previously done by rklogd)
$ModLoad imklog
# Provides support for local system logging (e.g. via logger command)
$ModLoad imuxsock
#UDP log
$ModLoad imudp
$UDPServerRun 514
#TCP log
$ModLoad imtcp
$InputTCPServerRun 514

#rsyslog clients, Process remote messages
:fromhost-ip, isequal, "10.99.55.186" /var/log/syslogclient1.log
:fromhost-ip, isequal, "10.99.55.210" /var/log/syslogclient2log


# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.*                                                 /dev/console

# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none                /var/log/messages

# The authpriv file has restricted access.
authpriv.*                                            /var/log/secure

# Log all the mail messages in one place.
mail.*                                                  -/var/log/maillog


# Log cron stuff
cron.*                                                  /var/log/cron

# Everybody gets emergency messages
*.emerg                                                 *

# Save news errors of level crit and higher in a special file.
uucp,news.crit                                          /var/log/spooler

# Save boot messages also to boot.log
local7.*                                                /var/log/boot.log