updatedi add ip address and hostname in /etc/hosts ,and run all combinations of facilities with level using a testing programcan see all messages received with tcpdump, but still no log files createdrsyslog server has two ethernet cards, and two ip addresssame vlan 53 , other hosts can create log file in /var/log/remotebut some window host send udp syslog , they can not create log file in the linux[root@xcpalx03 rsyslog.d]# cat 40-from-remote.conf#  Default rules for remote server logs# log every host in its own directory$template RemoteHost,/var/log/remote/%HOSTNAME%.log#if $hostname != 'xcpalx03new1' then {#if $hostname != 'xcpalx04' then {if $hostname != 'xcpalx03' then {        *.* ?RemoteHost        stop}[root@xcpalx11 rsyslog.d]# tcpdump -nni -n udp -i eth2 | grep 192.168.53.151tcpdump: verbose output suppressed, use -v or -vv for full protocol decodelistening on eth2, link-type EN10MB (Ethernet), capture size 65535 bytes00:17:31.357301 IP 192.168.53.151.60896 > 192.168.53.170.514: SYSLOG local4.error, length: 1800:17:31.358174 IP 192.168.53.151.60897 > 192.168.53.170.514: SYSLOG local4.error, length: 18after troubleshooting with tcpdump, it can receive udp message from windowbut no log file created in /var/log/remote
how to solve no syslog file created problem when other ip address can have syslog created
rsyslog