Re: Syslog write to file question

Are you using the IP Address filter and selecting IPV4 Range filter type? 

I would use the IP Address filter and the 'Simple' filter type unless you truly have a large range of contiguous addresses.

You can have one rule per IP address or something like this:

The Include would look like this:  "192.168.1.1","192.168.1.2", "192.168.3"

Then I would have a Log to File action. The path and file name would be something like C:\logs\%Hostname.txt.  %Hostname is an Auto-split variable that will use the hostname(or IP address if there is no hostname) to generate the file name.  I prefer this over the IP Address Auto-split because it handles both hostname and IP address.

Any other actions(displays, etc)

The last action would be 'Stop Processing'.

This will generate 1 file for each IP Address.

The default rule does not need any filters/excludes for these IP addresses.  The Stop processing command in the prior rule(s) will prevent them from hitting the next rule.