+1
0
-1
1
answer

NXLOG service won't start when config changed

After a bit of trial and and lots of reading, I managed to get Graylog2 working like a charm

I'm using NXLOG to send the logs to Graylog via GELF UDP

Right now I'm just testing and trying diffrent things.

Right now I';m testing with just 4 servers (have close to 100) has consumed a fair bit of space

So to evaluate usage, I figured I'd just send the security logs (these are all Windows Servers)

AskedNovember 21, 2016 - 6:12pm
+1
0
-1
1
answer

problems with nxlog-ce and load balancing

 

I am using nxlog-ce clients in windows machines, with om_ssl.  NXlog seems to keep the connection open, but does not send anything, except for the bursts for every Poll Interval.  The load balancer seems confused, and tries to send every second burst to a different server.  Is there any option to tell nxlog-ce that it should make a new connection for each burst, so that the load balancer can easily balance the load for different clients to different log servers?

AskedNovember 20, 2016 - 1:07pm
+1
0
-1
1
answer

Data loss UDP - no errors found - NXLOG data delayed more than 5 minutes

Hello,

 

I have 2 infrastructures installed one on Amazon and another on premises. On Amazon every thing is OK, but when I send logs on premises I have a 5 to 7 minutes delayed and I loss almost 30% of the data,

I activated the buffer option and I pass through it before sending logs to my on premise server but it doesn't work

Somebody know how to correct that?

 

Thank you for your help and answer

 

Ana

AskedNovember 18, 2016 - 5:31pm
+1
0
-1
1
answer

How to add a field for the file offset?

We are pushing logs from file with the im_file module to logstash and then to elasticsearch. However, some of these logs only have second accuracy, and therefore not returned in order by elasticsearch when sorted by just the time. To get around this problem, we would like to add the position of the log event to a field that we store (for example beginning line number or byte offset within the source file).

AskedNovember 18, 2016 - 1:11am
+1
0
-1
1
answer

Regular expression issue within pm_pattern

I have the following regexp:

^\s*(\d{2}:\d{2}:\d{2}\.\d{4})\s+(\[\S+\])\s+([\s\S]*)$

and a line from the log that I am trying to parse (there are some spaces at the beginning of the line):

 13:33:00.1205 [-] Persisting VDOM path /

trying to process a file using pm_pattern module with LogLevel DEBUG this is what I get:

AskedNovember 16, 2016 - 11:17am

Pages