Issue with rsyslog creating mutliple log files from a remote cisco switch
Solution 1:
Example of message is follow:
2021-10-13T14:41:10.866435-07:00 X 156613: X-Switch: .Oct 13 13:40:44 PST: %LINEPROTO-SW1-5-UPDOWN: Line protocol on Interface GigabitEthernet195/1/0/11, changed state to down
Seems that PROGRAMNAME points to the number which is incremented by one with every message, in this specific case 156613:
$template TmplAuth, "/var/log/client_logs/%HOSTNAME%/%PROGRAMNAME%.log"
So config above looks correct. Root cause is probably PROGRAMNAME which is incremented in the message.