/etc/rsyslog.conf

• cat /etc/rsyslog.conf | grep -v "#" | grep .

module(load="imklog" permitnonkernelfacility="on")
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$RepeatedMsgReduction on
$FileOwner syslog
$FileGroup adm
$FileCreateMode 0640
$DirCreateMode 0755
$Umask 0022
$PrivDropToUser syslog
$PrivDropToGroup syslog
$WorkDirectory /var/spool/rsyslog
$IncludeConfig /etc/rsyslog.d/*.conf

Configure remote log support

# provides UDP syslog reception
module(load="imudp")
input(type="imudp" port="514")

# provides TCP syslog reception
module(load="imtcp")
input(type="imtcp" port="514")

if $fromhost-ip == '10.10.xx.xx' then {
  /var/log/your_filename.log
 stop
}

See also

• Syslog, rsyslogd, /etc/rsyslog.conf, PAN-OS syslog