$template DynLocalAuth, "/var/log/rsyslog/local/auth/auth.%syslogseverity-text%.log"
$template DynRemoteAuth, "/var/log/rsyslog/remote/%hostname:::secpath-replace%/auth/auth.%syslogseverity-text%.log"

%if %%getVar('activer_reception_logs', 'non') == 'non'
auth,authpriv.* ?DynLocalAuth
%else
if $syslogfacility-text startswith 'auth' and $fromhost-ip startswith '127' then ?DynLocalAuth

 %if %%mode_conteneur_actif == 'oui'
if $syslogfacility-text startswith 'auth' and ($fromhost-ip startswith '%%adresse_ip_br0[:-2]' or $fromhost startswith '%%adresse_ip_br0[:-2]') then ?DynLocalAuth

if $syslogfacility-text startswith 'auth' and not ($fromhost-ip startswith '%%adresse_ip_br0[:-2]' or $fromhost startswith '%%adresse_ip_br0[:-2]' or $fromhost-ip startswith '127') then ?DynRemoteAuth

 %else
if $syslogfacility-text startswith 'auth' and not ($fromhost-ip startswith '%%adresse_ip_br0[:-2]' or $fromhost startswith '%%adresse_ip_br0[:-2]' or $fromhost-ip startswith '127') then ?DynRemoteAuth
 %end if
%end if

