How to disable remote emergency events flooding the consoles on an rsyslog reciever?

Question

In a centralized logging facility, how do I prevent remote emergency messages from flooding users' consoles while still allowing the default

*.emerg    :omusrmsg:*

For any local emerg events?

In particular, I would like to log remote emerg messages to log files, and possibly send an email, but the remote machines shouldn't disrupt work on the master server.

The master server is RHEL 7.4 x86_64
rsyslog version: 8.24.0

server side configuration (snipped):
/etc/rsyslog.conf:

$ModLoad imuxsock
$ModLoad imjournal
$ModLoad imudp
$UDPServerRun 514
$ModLoad imtcp
$InputTCPServerRun 514
*.emerg    :omusrmsg:*
$OmitLocalLogging on

/etc/rsyslog.d/listen.conf:

$systemLogSocketName /run/systemd/journal/syslog

Answer 1

Created a new /etc/rsyslog.d/remote-emerg.conf file:

$template myFormat0,"%timegenerated% %FROMHOST-IP% %syslogtag% %msg:::drop-last-lf\n"
if $fromhost-ip != '127.0.0.1' and $syslogseverity-text == 'emerg' then {
*.emerg /var/log/remote/PANIC;myFormat0
stop
}

Note: I tried using %HOSTNAME% instead of %FROMHOST-IP% but it alwayes printed localhost even when the remote hostname is configured correctly.

To test run both localy and on a remote host:

logger -p daemon.emerg "TEST from $HOSTNAME"

local run prints to cosole, remote is only logged to the file PANIC