log some messages with the template RSYSLOG_DebugFormt and you can see exactly
what rsyslog has to work with
99% of the time, the log message is not what you think it is.
David Lang
On Wed, 25 Mar 2020, John Chivian via rsyslog
wrote:
Date: Wed, 25 Mar 2020 10:09:08 -0500
From: John Chivian via rsyslog <rsyslog@lists.adiscon.com>
To: rsyslog@lists.adiscon.com
Cc: John Chivian <jchiv...@chivian.com>
Subject: Re: [rsyslog] Help separating out my home automation logs
If the text "tasmota" is in the message, not the header, your test will
work. However, if that text is in the header only it won't work. Try...
if ($rawmsg contains "tasmota")
...to catch that case (and in fact both cases).
Regards,
On 3/25/20 9:55 AM, Scott Baker via rsyslog wrote:
I'm setting up some home automation stuff and I want to break out all
my home automation (tasmota) syslog messages to their own file. I have
this very simple rsyslog config in |/etc/rsyslog.d/tasmota.conf|:
|template(name="tasmota" type="string" string="/var/log/tasmota.log")
if ($msg contains "tasmota") then { action(type="omfile"
DynaFile="tasmota" FileCreateMode="0644") stop } |
After restarting |rsyslog| it works for about half the messages:
|==> /var/log/tasmota.log <== Mar 21 11:06:38 tasmota-roland ESP-HTP:
Web server active on... Mar 21 11:06:38 tasmota-roland ESP-RSL: INFO1
= {...} Mar 21 11:06:38 tasmota-roland ESP-RSL: INFO2 = {...} ==>
/var/log/messages <== Mar 21 11:06:38 tasmota-roland ESP-RSL: INFO3 =
{...} Mar 21 11:06:38 tasmota-roland ESP-RSL: RESULT = {"POWER":"ON"}
Mar 21 11:06:38 tasmota-roland ESP-RSL: POWER = ON |
This is on Fedora using Rsyslog 8.30. I've confirmed the the tasmota
config loads before any of the system stuff that puts everything in
|/var/log/message|.
Lines that *should* match, are slipping through to |/var/log/message|.
It's super frustrating.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST
if you DON'T LIKE THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T
LIKE THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
