create syslog host 1 ipaddress $syslog_server severity all state enable
enable syslog

grep -i udp /etc/rsyslog.conf
$ModLoad imudp
$UDPServerAddress $syslog_server
$UDPServerRun 514

head /etc/rsyslog.d/dev_syslog.conf -n11
$template badports,"/var/log/switches/badports.log"
$template RemoteFromHost,"/var/log/switches/%FROMHOST%.log"

:msg, contains, "LBD" ?badports
:msg, contains, "LBD" ~
:fromhost, isequal, "ип_коммутатора1" ?RemoteFromHost
:fromhost, isequal, "ип_коммутатора1" ~
:fromhost, isequal, "ип_коммутатора2" ?RemoteFromHost
:fromhost, isequal, "ип_коммутатора2" ~
:fromhost, isequal, "ип_коммутатора3" ?RemoteFromHost
:fromhost, isequal, "ип_коммутатора3" ~