The problem seems to be that there's a leading space in the message. :msg, startswith, " FIRE " -/var/log/fire.log -> should work (at least for me it does)
I've seen on the debug log (rsyslog -d -n), this thing: ---- var '$msg': ' message goes here' ---- Which, via Google, lead me here: http://www.rsyslog.com/log- normalization-and-the-leading-space/ Where it says "The answer is, that messages are processed as RFC3164. In this RFC it is defined, that everything after the “:” of the syslog header is to be considered as the message. Thus, the message has a leading space now." -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/479592 Title: rsyslog doesn't work with property filter 'startswith' To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/rsyslog/+bug/479592/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
