How to configure a debian (Wheezy) rsyslog daemon to receive logs from remote system, store them in a separate directory/file and the daily rotate these files with date-like extension.

What we want:

/var/log/
├── alternatives.log
├── alternatives.log.1
.
.
.
├── remote
│   ├── remote1_host_IP
│   │   ├── remote1_host.log
│   │   ├── remote1_host.log-20141202.gz
│   │   ├── remote1_host.log-20141203.gz
│   │   └── remote1_host.log-20141204
│   ├── remote2_host_IP
│   │   ├── remote2_host.log
│   │   ├── remote2_host.log-20141202.gz
│   │   ├── remote2_host.log-20141203.gz
│   │   └── remote2_host.log-20141204
│   └── remote3_host_IP
│       ├── remote3_host.log
│       ├── remote3_host.log-20141202.gz
│       ├── remote3_host.log-20141203.gz
│       └── remote3_host.log-20141204
├── syslog
.
.

First add the /etc/rsyslog.d/myremote.conf file as

#  /etc/rsyslog.conf Configuration file for rsyslog.

# The file name format to be used
$template DynFile,"/var/log/remote/%fromhost-ip%/%HOSTNAME%.log"

# define new ruleset and add rules to it
$RuleSet remote

# redirect everything to the file.
*.* -?DynFile

# switch back to the default ruleset:
$RuleSet RSYSLOG_DefaultRuleset

# Bind the remote messages to the ruleset remote.
# NOTE: the server must be started after the BindRuleset
$ModLoad imudp
$InputUDPServerBindRuleset remote
$UDPServerRun 514

and in the /etc/logrotate.d/rsyslog (keep 200 days) add these lines:

/var/log/remote/*/*.log
{
        rotate 200
        daily
        dateext
        missingok
        notifempty
        delaycompress
        compress
        postrotate
                invoke-rc.d rsyslog rotate > /dev/null
        endscript
}

in the remote hosts just add somewhere in the /etc/rsyslog.conf file

*.* @mylogserver.mydomain

update Thu Dec 11 16:38:49 CET 2014: Store the remote hosts directory as IP because same hostname but different FQDN will end in the same file (ex. host1.example.com and host1.subdomain.example.com will be both stored into the host1/host1.log file)

-> Send a comment: Unless requested otherwise I may add it, or some extract, to this page.