Thank you kstone
what do you mean by host logs and catchall logs, is not the same logs?
for our environment the logs is like this "SyslogCatchAll-2016-10-17-010.200.018.025", so the IP address is added to the end of the file name. I am sorry that I didn't get your explanation well. is it possible to provide steps is how to do what you explained above. and provide screenshots if possible?
Thanks