I am trying to log messages from a specific remote host to a separate log file (and only to that file). I tried this:
# cat /etc/rsyslog.d/avs110door.conf if $fromhost == 'avs110' then /var/log/avs110-door.log & stop
The log file is not created, and the messages form that host are still sent to user.log, syslog, messages and auth.log (depending on the facility).
I did run
systemctl restart rsyslog.service and other .conf files from that directory do work as expected.
This is a server with rsyslog version 8.4.2
The messages in the wrong files are like this (so the remote hostname is indeed 'avs110' as in my .conf file condition):
Jul 18 18:27:19 avs110 sshd: Server listening on :: port 22. Jul 18 18:27:39 avs110 engine: Finished initialization Jul 18 18:44:20 avs110 engine: Calling sip:firstname.lastname@example.org:5060