root@lovejoy:~# mkdir /var/log/remote
root@lovejoy:~# nano /etc/rsyslog.conf
# provides UDP syslog reception
$ModLoad imudp
$UDPServerRun 514

# provides TCP syslog reception
$ModLoad imtcp
$InputTCPServerRun 514

# rules
if $fromhost-ip startswith '10.0.0.1' then /var/log/remote/host.log
& stop
root@lovejoy:~# /etc/init.d/rsyslog restart