Device log?

[gwp1]

@toggledbits is there a log that will show me what rule is turning on a specific device?

I've got a switch that has been kicking on at 2200 ET for several nights now and the reactor.log doesn't have a thing in it that I can see on a device level (it being more rules-based).

[toggledbits]

You list Hubitat and HASS as hubs, and the default logging for both of these hubs should tell you what you need to know. I've tried to keep these messages fairly consistent across the controllers, generally in this form:

[...]2025-11-25T12:45:08.121Z <xxx:INFO> xxx#house perform power_switch.set on Switch#house>device_396 with { "state": false }

Search using the canonical entity ID. There are several capabilities that can turn a light on, so searching by capability is harder. The idea is to find a perform ??? on ??? with ??? at the right time with the right entity ID.

From there, start looking backwards for a message like either one of these:

[...]2025-11-25T12:45:00.100Z <Engine:NOTICE> Starting reaction Parking Area Light Off (re-lk5lrx5a)

    or 

[...]2025-11-25T12:45:08.121Z <Engine:INFO> Resuming reaction Parking Area Light Off (re-lk5lrx5a) from step 3

If this line is within just a couple of lines, maybe even directly before, the perform log entry you found above, then that's the name of the Reaction that manipulated the device. If that has :S or :R at the end of its ID and the tag <SET> or <RESET> appended to the Reaction name, the Reaction is part of a Rule with that ID and name, and that is the rule that is manipulating the entity — you're done!

If the Reaction ID doesn't have the :S or :R suffix, then the Reaction is not rule-based (e.g. it's a global reaction), and you need to find what launched it.

If the line you've found is of the form Resuming "<reaction name>" (reaction id)" from step n, then keep looking backwards. You may find more Resuming lines for other steps of the same reaction, but your goal now is to find the line that looks like Starting "<reaction name>" (reaction id).

Once you are on the Starting "<reaction name>" (reaction id) line, you should not have to look very far to find an Enqueuing "<reaction name>" (reaction id) line.

Once you are on the Enqueueing line, you should not have to look very far to find another Resuming or Starting reaction line. This line may have the :S and :R on the reaction ID that you are looking for to indicate the rule that launched the reaction. If it doesn't, then the reaction was launched by another reaction, and you just repeat the above process looking for what started this reaction. This path will eventually lead to the responsible rule.

Live example from my host this morning. The perform action we found above is for an outdoor flood light that lights a parking pad at my house. It got turned off. By what, though? Well, we already established that is was by a reaction called Parking Area Light Off because we found a Resuming line for that reaction right before the perform line for the entity. Let's keep digging to find the responsible rule. Here's are some more relevant lines from my log:

[...]2025-11-25T12:45:00.067Z <Engine:INFO> Enqueueing "Morning Lighting Off<SET>" (rule-knjifbn1:S)
[...]2025-11-25T12:45:00.078Z <Engine:NOTICE> Starting reaction Morning Lighting Off<SET> (rule-knjifbn1:S)
[...]2025-11-25T12:45:00.078Z <Engine:INFO> Enqueueing "Outdoor All Off" (re-kl73syb6)
.
.
[...]2025-11-25T12:45:00.088Z <Engine:NOTICE> Starting reaction Outdoor All Off (re-kl73syb6)
[...]2025-11-25T12:45:00.089Z <Engine:INFO> Enqueueing "Parking Area Light Off" (re-lk5lrx5a)
.
.
[...]2025-11-25T12:45:00.100Z <Engine:NOTICE> Starting reaction Parking Area Light Off (re-lk5lrx5a)
.
.
[...]2025-11-25T12:45:00.118Z <Engine:INFO> Resuming reaction Parking Area Light Off (re-lk5lrx5a) from step 2
[...]2025-11-25T12:45:00.119Z <Engine:NOTICE> Parking Area Light Off delaying until 1764074708119<11/25/2025, 7:45:08 AM>
.
.
[...]2025-11-25T12:45:08.121Z <Engine:INFO> Resuming reaction Parking Area Light Off (re-lk5lrx5a) from step 3

Working backwards from the last line, which is the Resuming line that we found earlier (step 3), we find a Resuming line for the previous step (2) of that same reaction at 12:45:00.118. Notice also that reaction had a delay in it that was logged immediately after, which accounts for the time gap between steps 2 and 3.

Keep going backwards to 12:45:00.100 and we find the Starting line for that Parking Area Light Off reaction. And continuing to look backwards for that same reaction ID, we eventually find the Enqueueing line for it (12:45:00.089). Usually these two lines are pretty close together, but it's not usual to have other things logged between.

Now just looking backward line by line (not searching for any ID here), we soon find a Starting reaction Outdoor All Off line (12:45:00.088) very close to our Enqueueing line, indicating that Outdoor All Off launched the Parking Area Light Off reaction.

Now we just repeat this process with Outdoor All Off — find it enqueued at 12:45:00.078 by Morning Light Off<SET> also at 12:45:00.078. The <SET> on the name and :S on the ID means it's a rule reaction, so Morning Light Off is the rule that triggered and started the sequence of two other reactions that eventually turned off the light.

So to recap:

1. Find the perform line (search using entity ID) that occurs at about the right time.
2. Look backwards a short distance and you will find either a Starting <reaction> or Resuming <reaction> line. If that's a rule's SET or RESET reaction, you've found the responsible rule. Otherwise, a global reaction manipulated the entity/device, so proceed to the next step.
3. Find what launched the current reaction. Keep looking backward until you find the Enqueueing line for it. Then very shortly preceding it, you should find a Starting <reaction> or Resuming <reaction> line for a different reaction. That's what started the current reaction. If this new reaction is a rule's SET or RESET reaction, you've found the responsible rule. Otherwise, find what launched this new (global) reaction by repeating this step.

NOTE: Almost all actions in Reactor are asynchronous, meaning the Engine launches them in a separate process and the Engine can move on to working on a different reaction if multiple are running concurrently. Some in particular can take a lot of time (like HTTP Request). Depending on how busy your system is in that moment, all of these lines can be separated by other lines for other things going on, and you have to be careful and patient sifting through them.