Are the rules before the default rule working? Are they creating the logs as you configured it? If you have 'Stop Processing' as the last action in the first rule and the default rule still sees the messages I would think that the first, specific, rule isn't matching.
↧
