Mailing List Archive: Help separating out my home automation logs

Help separating out my home automation logs

Mar 25, 2020, 7:55 AM

Post #1 of 3 (442 views)

I'm setting up some home automation stuff and I want to break out all my
home automation (tasmota) syslog messages to their own file. I have this
very simple rsyslog config in |/etc/rsyslog.d/tasmota.conf|:

|template(name="tasmota" type="string" string="/var/log/tasmota.log") if
($msg contains "tasmota") then { action(type="omfile" DynaFile="tasmota"
FileCreateMode="0644") stop } |

After restarting |rsyslog| it works for about half the messages:

|==> /var/log/tasmota.log <== Mar 21 11:06:38 tasmota-roland ESP-HTP:
Web server active on... Mar 21 11:06:38 tasmota-roland ESP-RSL: INFO1 =
{...} Mar 21 11:06:38 tasmota-roland ESP-RSL: INFO2 = {...} ==>
/var/log/messages <== Mar 21 11:06:38 tasmota-roland ESP-RSL: INFO3 =
{...} Mar 21 11:06:38 tasmota-roland ESP-RSL: RESULT = {"POWER":"ON"}
Mar 21 11:06:38 tasmota-roland ESP-RSL: POWER = ON |

This is on Fedora using Rsyslog 8.30. I've confirmed the the tasmota
config loads before any of the system stuff that puts everything in
|/var/log/message|.

Lines that *should* match, are slipping through to |/var/log/message|.
It's super frustrating.

_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

Re: Help separating out my home automation logs [ In reply to ]

rsyslog at lists

Mar 25, 2020, 8:09 AM

Post #2 of 3 (442 views)

Permalink

If the text "tasmota" is in the message, not the header, your test will
work. However, if that text is in the header only it won't work. Try...

if ($rawmsg contains "tasmota")

...to catch that case (and in fact both cases).

Regards,

On 3/25/20 9:55 AM, Scott Baker via rsyslog wrote:
> I'm setting up some home automation stuff and I want to break out all
> my home automation (tasmota) syslog messages to their own file. I have
> this very simple rsyslog config in |/etc/rsyslog.d/tasmota.conf|:
>
> |template(name="tasmota" type="string" string="/var/log/tasmota.log")
> if ($msg contains "tasmota") then { action(type="omfile"
> DynaFile="tasmota" FileCreateMode="0644") stop } |
>
> After restarting |rsyslog| it works for about half the messages:
>
> |==> /var/log/tasmota.log <== Mar 21 11:06:38 tasmota-roland ESP-HTP:
> Web server active on... Mar 21 11:06:38 tasmota-roland ESP-RSL: INFO1
> = {...} Mar 21 11:06:38 tasmota-roland ESP-RSL: INFO2 = {...} ==>
> /var/log/messages <== Mar 21 11:06:38 tasmota-roland ESP-RSL: INFO3 =
> {...} Mar 21 11:06:38 tasmota-roland ESP-RSL: RESULT = {"POWER":"ON"}
> Mar 21 11:06:38 tasmota-roland ESP-RSL: POWER = ON |
>
> This is on Fedora using Rsyslog 8.30. I've confirmed the the tasmota
> config loads before any of the system stuff that puts everything in
> |/var/log/message|.
>
> Lines that *should* match, are slipping through to |/var/log/message|.
> It's super frustrating.
>
> _______________________________________________
> rsyslog mailing list
> https://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST
> if you DON'T LIKE THAT.

_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.

Re: Help separating out my home automation logs [ In reply to ]

rsyslog at lists

Mar 25, 2020, 1:01 PM

Post #3 of 3 (440 views)

Permalink

log some messages with the template RSYSLOG_DebugFormt and you can see exactly
what rsyslog has to work with

99% of the time, the log message is not what you think it is.

David Lang

On Wed, 25 Mar 2020, John Chivian via rsyslog
wrote:

> Date: Wed, 25 Mar 2020 10:09:08 -0500
> From: John Chivian via rsyslog <rsyslog@lists.adiscon.com>
> To: rsyslog@lists.adiscon.com
> Cc: John Chivian <jchivian@chivian.com>
> Subject: Re: [rsyslog] Help separating out my home automation logs
>
> If the text "tasmota" is in the message, not the header, your test will
> work. However, if that text is in the header only it won't work. Try...
>
> if ($rawmsg contains "tasmota")
>
> ...to catch that case (and in fact both cases).
>
> Regards,
>
>
>
> On 3/25/20 9:55 AM, Scott Baker via rsyslog wrote:
>> I'm setting up some home automation stuff and I want to break out all
>> my home automation (tasmota) syslog messages to their own file. I have
>> this very simple rsyslog config in |/etc/rsyslog.d/tasmota.conf|:
>>
>> |template(name="tasmota" type="string" string="/var/log/tasmota.log")
>> if ($msg contains "tasmota") then { action(type="omfile"
>> DynaFile="tasmota" FileCreateMode="0644") stop } |
>>
>> After restarting |rsyslog| it works for about half the messages:
>>
>> |==> /var/log/tasmota.log <== Mar 21 11:06:38 tasmota-roland ESP-HTP:
>> Web server active on... Mar 21 11:06:38 tasmota-roland ESP-RSL: INFO1
>> = {...} Mar 21 11:06:38 tasmota-roland ESP-RSL: INFO2 = {...} ==>
>> /var/log/messages <== Mar 21 11:06:38 tasmota-roland ESP-RSL: INFO3 =
>> {...} Mar 21 11:06:38 tasmota-roland ESP-RSL: RESULT = {"POWER":"ON"}
>> Mar 21 11:06:38 tasmota-roland ESP-RSL: POWER = ON |
>>
>> This is on Fedora using Rsyslog 8.30. I've confirmed the the tasmota
>> config loads before any of the system stuff that puts everything in
>> |/var/log/message|.
>>
>> Lines that *should* match, are slipping through to |/var/log/message|.
>> It's super frustrating.
>>
>> _______________________________________________
>> rsyslog mailing list
>> https://lists.adiscon.net/mailman/listinfo/rsyslog
>> http://www.rsyslog.com/professional-services/
>> What's up with rsyslog? Follow https://twitter.com/rgerhards
>> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a
>> myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST
>> if you DON'T LIKE THAT.
>
>
> _______________________________________________
> rsyslog mailing list
> https://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
> sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T
> LIKE THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.