Debian :: Rsyslog Remote Logging Duplicates

I'm having issues setting up rsyslog to receive syslog from another server and only log to one file. I'm receiving the syslog from the remote side, however its putting the entries into more than one log file.

I configured /etc/rsyslog.conf to enable udp, and I have implemented a filter to log only from that IP address, and then stop processing more rules, but it seems to continue on.

I have found that the remote syslog events are using local0 and local1. There are two custom rsyslog config files in /etc/rsyslog.d that handle those two facilities. If I use that same if statement at the beginning of those custom config files, I can get it to work. Seems like a hack though.

Not working:

I put my if statement before the include statement, thinking I could stop it from hitting the custom rules.

Code:
Select all#  /etc/rsyslog.conf    Configuration file for rsyslog v3.
#
#                       For more information see
#                       /usr/share/doc/rsyslog-doc/html/rsyslog_conf.html

#################
#### MODULES ####
#################

$ModLoad imuxsock # provides support for local system logging
$ModLoad imklog   # provides kernel logging support (previously done by rklogd)
#$ModLoad immark  # provides --MARK-- message capability

[Code] ....

This works:
A custom config file in /etc/rsyslog.d
Code: Select allif $fromhost-ip == '<my ip>' then /var/log/<my directory>/syslog.log
& ~
local0.*       /var/log/<a log file for local0>.log

This is on a WD Mycloud device:

Code: Select allLinux WDMyCloud 3.2.26 #1 SMP Tue Jun 17 15:53:22 PDT 2014 wd-2.2-rel armv7l

The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright.