I am trying to configure rsyslog (Ubuntu 12.04 Server) to log events from my router. I found this link which got me most of the way there. I am able to get the events logged from the router, and since I don't them logged in syslog, I set up a filter in rsyslog.conf like this:

:fromhost-ip, isequal, "192.168.2.1" /var/log/linksys.log
& ~

This works, the only problem is now I am not getting any SSHD logs in auth.log. I am really stumped why this would be, SSHD is a local service. I tried using a different filter instead:

:msg,contains, "RV042" /var/log/linksys.log
& ~

since RV042 is the name of the router, but this doesn't log anything. Any ideas?