We have a shared hosting server that handles many Drupal sites within their own Apache virtual hosts. We had a need to track all available log messages for long periods of time, which the core watchdog module wouldn't allow us to do. So, we enabled the syslog module to write the messages to log files on the server.
To get all of the sites into their own log files we had to add the following code to /etc/rsyslog.d/drupal.conf
if $programname == 'SITE_1_SYSLOG_ID' then /var/log/drupal/SITE_1.log
if $programname == 'SITE_2_SYSLOG_ID' then /var/log/drupal/SITE_2.log
if $programname == 'SITE_3_SYSLOG_ID' then /var/log/drupal/SITE_3.log
& ~
local0.* /var/log/drupal/default.log
& ~
In the above, the 'SITE_*_SYSLOG_ID' is the value that is placed within the syslog identity on the logging configuration page: admin/config/development/logging
The code between the '& ~' catches any default sites that didn't get added to the .conf file.
Note: All of the sites need to placed into one configuration file. Otherwise, rsyslog will use the first configuration file it comes across (alphabetical I believe) and the other .conf files will not be run.