Try with cron.none . If you use * an asterisk ( * ) matches zero or more occurrences.
Now your can modify the rule in order to move the log to another file /path/to/another/file
UPDATE
The following compare-operations are currently supported:
contains
Checks if the string provided in value is contained in the property. There must be an exact match, wildcards are not supported.
isequal
Compares the “value” string provided and the property contents. These two values must be exactly equal to match. The difference to contains is that contains searches for the value anywhere inside the property value, whereas all characters must be identical for isequal. As such, isequal is most useful for fields like syslogtag or FROMHOST, where you probably know the exact contents.
startswith
Checks if the value is found exactly at the beginning of the property value. For example, if you search for “val” with
:msg, startswith, "val"
it will be a match if msg contains “values are in this message” but it won’t match if the msg contains “There are values in this message” (in the later case, “contains” would match). Please note that “startswith” is by far faster than regular expressions. So even once they are implemented, it can make very much sense (performance-wise) to use “startswith”.
regex
Compares the property against the provided POSIX BRE regular expression.
ereregex
Compares the property against the provided POSIX ERE regular expression.
You can use the bang-character (!) immediately in front of a compare-operation, the outcome of this operation is negated. For example, if msg contains “This is an informative message”, the following sample would not match:
:msg, contains, "error"
but this one matches:
:msg, !contains, "error"
Using negation can be useful if you would like to do some generic processing but exclude some specific events. You can use the discard action in conjunction with that. A sample would be:
*.* /var/log/allmsgs-including-informational.log
:msg, contains, "informational" ~
*.* /var/log/allmsgs-but-informational.log
Do not overlook the tilde in line 2! In this sample, all messages are written to the file allmsgs-including-informational.log. Then, all messages containing the string “informational” are discarded. That means the config file lines below the “discard line” (number 2 in our sample) will not be applied to this message. Then, all remaining lines will also be written to the file allmsgs-but-informational.log.
