If the text "tasmota" is in the message, not the header, your test will
work. However, if that text is in the header only it won't work. Try...
if ($rawmsg contains "tasmota")
...to catch that case (and in fact both cases).
Regards,
On 3/25/20 9:55 AM, Scott Baker via rsyslog wrote:
I'm setting up some home automation stuff and I want to break out all
my home automation (tasmota) syslog messages to their own file. I have
this very simple rsyslog config in |/etc/rsyslog.d/tasmota.conf|:
|template(name="tasmota" type="string" string="/var/log/tasmota.log")
if ($msg contains "tasmota") then { action(type="omfile"
DynaFile="tasmota" FileCreateMode="0644") stop } |
After restarting |rsyslog| it works for about half the messages:
|==> /var/log/tasmota.log <== Mar 21 11:06:38 tasmota-roland ESP-HTP:
Web server active on... Mar 21 11:06:38 tasmota-roland ESP-RSL: INFO1
= {...} Mar 21 11:06:38 tasmota-roland ESP-RSL: INFO2 = {...} ==>
/var/log/messages <== Mar 21 11:06:38 tasmota-roland ESP-RSL: INFO3 =
{...} Mar 21 11:06:38 tasmota-roland ESP-RSL: RESULT = {"POWER":"ON"}
Mar 21 11:06:38 tasmota-roland ESP-RSL: POWER = ON |
This is on Fedora using Rsyslog 8.30. I've confirmed the the tasmota
config loads before any of the system stuff that puts everything in
|/var/log/message|.
Lines that *should* match, are slipping through to |/var/log/message|.
It's super frustrating.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST
if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
