Ask questions. Get answers. Find technical product solutions from passionate experts in the NXLog community.
README: how to ask questions effectively
gahorvath Nxlog ✓ created
Hi All,please adhere to the guidelines below to get faster responses to your queries.1 State the problem clearly:I am trying to collect logs from a log file using im_file and NXLog reads the whole file after each restart.2 Provide your configurationin a code block:
```
configuration text
```3 provide the contents of nxlog.log in a code block2023-04-12 08:00:27 INFO [CORE|main] configuration OK
2023-04-12 08:00:27 INFO [CORE|main] nxlog-5.7.7898 (68bb24e7e@REL_v5.7) started on Linux
2023-04-12 08:00:27 INFO [om_batchcompress|to_relay] connecting to lab1.home(192.168.14.52):2514
2023-04-12 08:00:27 INFO [om_batchcompress|to_relay] tcp connection established with lab1.home(192.168.14.52):2514
2023-04-12 08:00:27 INFO [xm_admin|admin] connecting to lab1.home(192.168.14.52):4041
2023-04-12 08:00:27 INFO [xm_admin|admin] tcp connection established with lab1.home(192.168.14.52):4041
2023-04-12 08:00:28 INFO [im_fim|fim] Module 'fim': FIM scan started
2023-04-12 08:00:28 ERROR [im_fim|fim] Module 'fim' could not open file '/opt/nxlog/bin/upgrade-nxsec.sh': Permission denied
2023-04-12 08:00:28 INFO [im_fim|fim] Module 'fim': FIM scan finished in 0.05 seconds. Scanned folders: 15 Scanned files: 102 Read file bytes: 156746314 provide environment descriptionNXLog CE is running on Windows 2022 server Package version is 3.2.23295 provide relevant detailsThis configuration has been working before we updated from version 2.11Now it does not6 if your problem involves parsing data provide samples of your input and expected output as well as what you actually getMy data looks like this:{"message": “message1”, "time": Thu 20 Apr 10:48:43 CEST 2023}I am getting an error:> error message hereI would like to receive the time in UNIX time (seconds since Epoch)Using this format enables us to get started much faster, and perhaps address your issue in the very first response we writeWould that not be great? :) Thanks for your cooperation!Gabor
gahorvath Nxlog ✓ created
NXLog 32-Bit Installation
tputman created
Hello, Does anyone know how to install nxlog on a Windows 32-bit system? Windows Server 2003
tputman created
module csv_parser not found
mike.jung@gopai.com created
Hi:I am new to nxlog but I do haves sending windows events into graylog via nxlogs so I know some basics.I am know trying to parse csv exchange logs.I am running the community version.I realize I have no output or routing statements yet.The log does not complain about the module xm_csv being found but does complain about module csv_parser not being found.I used this as starting point: https://docs.nxlog.co/integrate/exchange.html using the community section for reference.If someone could offer any hints I would be most grateful.--mikejVersion: nxlog-ce-3.2.2329LOGFILE:C:\Program Files\nxlog\data>type nxlog.log2024-03-25 15:15:51 ERROR Couldn't parse Exec block at C:\Program Files\nxlog\conf\nxlog.d\\protocol.conf:21; couldn't parse statement at line 25, character 27 in C:\Program Files\nxlog\conf\nxlog.d\\protocol.conf; module csv_parser not found2024-03-25 15:15:51 ERROR Couldn't parse Exec block at C:\Program Files\nxlog\conf\nxlog.d\\protocol.conf:34; couldn't parse statement at line 38, character 26 in C:\Program Files\nxlog\conf\nxlog.d\\protocol.conf; module csv_parser not found2024-03-25 15:15:51 WARNING not starting unused module smtp_receive2024-03-25 15:15:51 WARNING not starting unused module smtp_send2024-03-25 15:15:51 INFO nxlog-ce-3.2.2329 startedCONFIG FILE: protocol.conf - in nxlog.ddefine BASEDIR C:\Program Files\Microsoft\Exchange Server\V15#Software: Microsoft Exchange Server#Version: 15.0.0.0#Log-type: SMTP Receive Protocol Log#Date: 2024-03-25T19:00:26.686Z#Fields: date-time,connector-id,session-id,sequence-number,local-endpoint,remote-endpoint,event,data,context## MJ number of fields matches count<Extension csv> Module xm_csv Fields date-time, connector-id, session-id, sequence-number, \ local-endpoint, remote-endpoint, event, data, context</Extension><Input smtp_receive>Module im_file File '%BASEDIR%\TransportRoles\Logs\Hub\ProtocolLog\SmtpReceive\RECV*.LOG'<Exec> if $raw_event =~ /^(\xEF\xBB\xBF)?(date-time,|#)/ drop(); else { csv_parser->parse_csv(); $EventTime = parsedate(${date-time}); }</Exec></Input><Input smtp_send>Module im_fileFile '%BASEDIR%\TransportRoles\Logs\Hub\ProtocolLog\SmtpSend\SEND*.LOG'<Exec> if $raw_event =~ /^(\xEF\xBB\xBF)?(date-time,|#)/ drop();else{ csv_parser->parse_csv(); $EventTime = parsedate(${date-time});}</Exec></Input>
mike.jung@gopai.com created
TLS over UDP (TLS) support?
bt02366 created
Been searching the internet to see if anyone has asked this before.Are there any plans for NXlog to support DTLS for secure low overhead forwarding?
bt02366 created
Missing dependencies
cam591 created
I find instructions for installing the Enterprise edition. I'm trying to install the Community edition. I can't find the tar file, only the rpm file.I cannot resolve all the missing dependencies:libc.so.6, libcrypt.so.2, libcrypto.so.3, libssl.so.3, libsystemd.so.0 I cannot convince my management to pay for the Enterprise edition without first demonstrating the Community edition. Since the documentation for the Community edition is so poor, I will not advocate paying to only find that the documentation for the Enterprise edition is no better. How do I install the needed dependencies?
cam591 created
NXLogs Not Being received
Nathan Wyatt created
Hello all, I have a bit of a problem and was hoping someone can put in their two cents. I have recently set up NXLogs to start sending DHCP logs to a second server for one of our security applications. However, there is no record of the logs being received by it (or any traffic to suggest that the logs are leaving the DHCP server). We are successfully receiving logs for the first Security Server, just not the second (most recent addition). I have ran a Netstat -a command from the DHCP server and it shows there is an active connection going to the correct IP range and port. We have looked at the firewall and found that there are no packets being dropped by it either, and also no records that traffic is going from our DHCP server to our second Security Server. So all in all, I'm at a bit of a loss for how to troubleshoot this and was wondering if anyone had any ideas? PSB for a copy of our .conf file, just in case anyone spots a glaring error (I have redacted IP ranges, ports, etc…) Panic Soft#NoFreeOnExit TRUEdefine ROOT C:\Program Files\nxlogdefine WINDHCP_OUTPUT_DESTINATION_ADDRESS x.x.x.xdefine WINDHCP_OUTPUT_DESTINATION_ADDRESS2 x.x.x.xdefine WINDHCP_OUTPUT_DESTINATION_PORT xxxxdefine WINDHCP_OUTPUT_DESTINATION_PORT2 xxxModuledir %ROOT%\modulesCacheDir %ROOT%\dataPidfile %ROOT%\data\nxlog.pidSpoolDir %ROOT%\dataLogFile %ROOT%\data\nxlog.log<Extension _json> Module xm_json</Extension><Input dhcp_server_eventlog> Module im_msvistalog <QueryXML> <QueryList> <Query Id="0" Path="System"> <Select Path="System">*[System[Provider[@Name='Microsoft-Windows-DHCP-Server']]]</Select> </Query> <Query Id="0"> <Select Path="DhcpAdminEvents">*</Select> <Select Path="Microsoft-Windows-Dhcp-Server/FilterNotifications">*</Select> <Select Path="Microsoft-Windows-Dhcp-Server/Operational">*</Select> </Query> </QueryList> </QueryXML> Exec $EventTime = integer($EventTime) / 1000; Exec $EventReceivedTime = integer($EventReceivedTime) / 1000; Exec to_json();</Input><Input audit_logs_csv> Module im_file File "c:\DHCP\-*.log" SavePos TRUE InputType LineBased Exec $Message = $raw_event;</Input><Output SecurityServer1> Module om_udp Host %WINDHCP_OUTPUT_DESTINATION_ADDRESS% Port %WINDHCP_OUTPUT_DESTINATION_PORT%</Output><Output SecurityServer2> Module om_udp Host %WINDHCP_OUTPUT_DESTINATION_ADDRESS2% Port %WINDHCP_OUTPUT_DESTINATION_PORT2%</Output><Route 1r> Path dhcp_server_eventlog,audit_logs_csv => SecurityServer1</Route><Route 2> Path dhcp_server_eventlog,audit_logs_csv => SecurityServer2</Route> Thanks in advance for the help.
Nathan Wyatt created
NXLOG Windows CE 2.9.1716
zaklewis created
Sorry if this has been asked before, but I couldn't find anything related.I'm after NXLOG version CE 2.9.1716 for Windows however only Ubuntu & Debian is available from the download section. Does anybody know how I can obtain the Windows file?
zaklewis created
Splitting Logs by filter and send them to two different Graylogs
reesthil created
Hello everyone,I'm trying to solve a problem that seems simple.I would like to log Windows events on two different log servers. I would like to send all relevant logs to a Graylog but without the MSSQL logs. These are filtered and sent to another Graylog.Filtering by “MSSQL-ONLY” works fine, but dropping MSSQL events does not work. I get all logs including MSSQL an the "logs" output.Any idea? Windows Server 2022, nxlog-ce-3.2.2329.msi define ROOT C:\Program Files\nxlog
define CERTDIR %ROOT%\cert
define CONFDIR %ROOT%\conf
define LOGDIR %ROOT%\data
define LOGFILE %LOGDIR%\nxlog.log
LogFile %LOGFILE%
Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
<Extension gelf>
Module xm_gelf
</Extension>
<Input eventlog>
Module im_msvistalog
Query <QueryList>
<Query Id="0">
<Select Path="Application"></Select>
<Select Path="System"></Select>
<Select Path="Security"></Select>
<Select Path="Microsoft-Windows-Windows Defender/Operational"></Select>
</Query>
</QueryList>
<Exec>
if ($SourceName = "SQLSERVER") drop();
</Exec>
</Input>
<Input sqllog>
Module im_msvistalog
Query <QueryList>
<Query Id="0">
<Select Path="Application">*[System[Provider[@Name='MSSQLSERVER']]]</Select>
</Query>
</QueryList>
</Input>
<Output logs>
Module om_tcp
Host graylog01.something.com
Port 12202
OutputType GELF_TCP
Exec $Hostname = 'XYZ.somthing.com';
</Output>
<Output sqllogs>
Module om_tcp
Host graylog02.something.com
Port 12202
OutputType GELF_TCP
Exec $Hostname = 'XYZ.somthing.com';
</Output>
<Route eventlog_to_udp>
Path eventlog => logs
</Route>
<Route sqllog_to_udp>
Path sqllog => sqllogs
</Route>
reesthil created
How to use wildcard on IM config file for YYMMDDN.log
Davin created
I would like to know how to use the wildcard if the logs name file contains a date. # Monitor application log files<Input watchfile> Module im_file File 'C:\\Application\\log\\240220N.Log' Exec $Message = $raw_event; Exec if file_name() =~ /.*\\(.*)/ $SourceName = $1; SavePos TRUE Recursive TRUE</Input>Thank you
Davin created
NXLogs routed to two destinations.
shahad1 created
We have configured NXLog to monitor DHCP server logs and sends it to two different destinations using TCP:what is the correct way of routing the output to two diffrent distnations..<Output out1> Module om_tcp Host destination1 Port XXX </Output><Output out2> Module om_tcp Host destination2 Port XXXX </Output><Route route1> Path input1 => out1 Path input2 => out2</Route>
shahad1 created
Issue with Large CSV Messages Being Truncated in Graylog Using NXLog
soc_nxlog created
I am experiencing a problem with the NXLog Graylog sidecarwhere large CSV messages are being truncated when sent to Graylog via im_file and xm_gelf. The issue occurs regardless of whether I use UDP or TCP transport. Specifically, when a single field (FullFormattedMessage) exceeds approximately 11,000 bytes, the message gets truncated to 64 characters in Graylog's interface causing the entire large field to be omitted. This truncation appears to be due to the $ShortMessage field, which has a character limit.Additionally, when the message is truncated, the $EventTime field, which is derived from a CSV column using parsedate(), does not parse correctly. It seems that when the message reaches its size limit, the $row_event is sent without executing any further processing. My current NXLog configuration is as follows:define INSTALLDIR /etc/nxlog
define CERTDIR %INSTALLDIR%/cert
define CONFDIR %INSTALLDIR%/nxlog.d
define LOGDIR /var/log/nxlog
define MYLOGFILE %LOGDIR%/nxlogCSVtest.log
LogLevel INFO
LogFile %MYLOGFILE%
<Extension csv>
Module xm_csv
Fields IpAddress,UserAgent,Key,CreatedTime,UserName,FullFormattedMessage
</Extension>
<Extension gelf>
Module xm_gelf
</Extension>
<Input file>
Module im_file
File '/home/user/test/logs_to_send.csv'
<Exec>
csv->parse_csv();
if ($UserName =~ /USER_A/) drop();
if (not defined($CreatedTime) or $CreatedTime=='' ) drop();
$EventTime = parsedate($CreatedTime);
$CreatedTime = undef;
# These fields are needed for Graylog
$gl2_source_collector = '${sidecar.nodeId}';
$collector_node_id = '${sidecar.nodeName}';
</Exec>
</Input>
<Output graylog_udp>
Module om_udp
Host 127.0.0.1
Port 5555
OutputType GELF_UDP
</Output>
<Route 1>
Path file => graylog_udp
</Route> The log file indicates an "Invalid CSV input" error for each row that is giving me the problem, but only displays the first 960 characters of the CSV rows in question.2024-02-13 16:59:08 ERROR Invalid CSV input: <the first 960 characters of the csv row> I am running NXLog CE on Ubuntu 22.04 with the Graylog sidecar, using package version nxlog-ce_3.2.2329_ubuntu22_amd64.On the data that desn't get the error it's working great, I know i'm hitting some limitation but i would like to know witch one and how can i change it.
soc_nxlog created
Send same Log to 2 Servers
trials@us.gnld.com created
Hi, I can send the log to 1 Server only. How do I send the same log to 2 server for just in case 1 got wipe out by ransomwareThis is the configuration that work for #1 Server. My #2 Server has different IP. What is the proper way to do this? <Extension _gelf> Module xm_gelf</Extension># Snare compatible example configuration# Collecting event log<Input in> Module im_msvistalog</Input># Sends Eevent in GELF format to Graylog Servers<Output out> Module om_udp Host 10.10.12.68 Port 12201 OutputType GELF</Output># # Connect input 'in' to output 'out'<Route 1> Path in => out</Route>
trials@us.gnld.com created
APPCRASH on Windows in Module im_msvistalog - Logs and Config added
reesthil created
Hi,sorry, just added config an logs….We have some installations of NXLOG in Version 3.2.2339. This works fine, but every 5 to 10 minutes we find exactly 50 events showing a crash of nxlog.exe in module im_msvistalog.Problem signature: P1: nxlog.exe P2: 0.0.0.0 P3: 643951bd P4: im_msvistalog.dll P5: 0.0.0.0 P6: 643951bd P7: c0000005 P8: 00000000000045b2 P9: P10: Any suggestions how to fix that?Thanks & Best regards, Thilo nxlog.cfg:define ROOT C:\Program Files\nxlog
define CERTDIR %ROOT%\cert
define CONFDIR %ROOT%\conf
define LOGDIR %ROOT%\data
define LOGFILE %LOGDIR%\nxlog.log
LogFile %LOGFILE%
Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
<Extension gelf>
Module xm_gelf
</Extension>
<Input eventlog>
Module im_msvistalog
Query <QueryList>
<Query Id="0">
<Select Path="Application"></Select>
<Select Path="System"></Select>
<Select Path="Security"></Select>
<Select Path="Microsoft-Windows-Windows Defender/Operational"></Select>
</Query>
</QueryList>
</Input>
<Output tcp>
Module om_tcp
Host graylog.xxxx.yyyy
Port 12202
OutputType GELF_TCP
Exec $Hostname = 'hostXYZ.xxxx.yyyy';
</Output>
<Route eventlog_to_udp>
Path eventlog => tcp
</Route>Crash-Event:Debug-Log atTime of Event (19:46:37)2024-02-14 19:46:37 DEBUG [tcp] no poll events, pollset_poll timed out
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: POLL (tcp)
2024-02-14 19:46:37 DEBUG event added to jobqueue
2024-02-14 19:46:37 DEBUG worker 1 processing event 0xa201b610
2024-02-14 19:46:37 DEBUG PROCESS_EVENT: POLL (tcp)
2024-02-14 19:46:37 DEBUG worker 0 got signal for new job
2024-02-14 19:46:37 DEBUG nx_module_pollset_poll: tcp
2024-02-14 19:46:37 DEBUG worker 0 got no event to process
2024-02-14 19:46:37 DEBUG worker 0 waiting for new event
2024-02-14 19:46:37 DEBUG [tcp] no poll events, pollset_poll timed out
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: POLL (tcp)
2024-02-14 19:46:37 DEBUG event added to jobqueue
2024-02-14 19:46:37 DEBUG worker 2 got signal for new job
2024-02-14 19:46:37 DEBUG worker 2 processing event 0xa201b840
2024-02-14 19:46:37 DEBUG worker 1 waiting for new event
2024-02-14 19:46:37 DEBUG PROCESS_EVENT: POLL (tcp)
2024-02-14 19:46:37 DEBUG nx_module_pollset_poll: tcp
2024-02-14 19:46:37 DEBUG [tcp] no poll events, pollset_poll timed out
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: POLL (tcp)
2024-02-14 19:46:37 DEBUG event added to jobqueue
2024-02-14 19:46:37 DEBUG worker 2 processing event 0xa23d49f0
2024-02-14 19:46:37 DEBUG PROCESS_EVENT: POLL (tcp)
2024-02-14 19:46:37 DEBUG nx_module_pollset_poll: tcp
2024-02-14 19:46:37 DEBUG worker 0 got signal for new job
2024-02-14 19:46:37 DEBUG worker 0 got no event to process
2024-02-14 19:46:37 DEBUG worker 0 waiting for new event
2024-02-14 19:46:37 DEBUG [tcp] no poll events, pollset_poll timed out
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: POLL (tcp)
2024-02-14 19:46:37 DEBUG event added to jobqueue
2024-02-14 19:46:37 DEBUG worker 1 got signal for new job
2024-02-14 19:46:37 DEBUG worker 1 processing event 0xa23d48b0
2024-02-14 19:46:37 DEBUG worker 2 waiting for new event
2024-02-14 19:46:37 DEBUG PROCESS_EVENT: POLL (tcp)
2024-02-14 19:46:37 DEBUG nx_module_pollset_poll: tcp
2024-02-14 19:46:37 DEBUG [tcp] no poll events, pollset_poll timed out
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: POLL (tcp)
2024-02-14 19:46:37 DEBUG event added to jobqueue
2024-02-14 19:46:37 DEBUG worker 0 got signal for new job
2024-02-14 19:46:37 DEBUG worker 0 processing event 0xa201b5c0
2024-02-14 19:46:37 DEBUG worker 1 waiting for new event
2024-02-14 19:46:37 DEBUG PROCESS_EVENT: POLL (tcp)
2024-02-14 19:46:37 DEBUG nx_module_pollset_poll: tcp
2024-02-14 19:46:37 DEBUG [tcp] no poll events, pollset_poll timed out
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: POLL (tcp)
2024-02-14 19:46:37 DEBUG event added to jobqueue
2024-02-14 19:46:37 DEBUG worker 2 got signal for new job
2024-02-14 19:46:37 DEBUG worker 2 processing event 0xa201b7a0
2024-02-14 19:46:37 DEBUG worker 0 waiting for new event
2024-02-14 19:46:37 DEBUG PROCESS_EVENT: POLL (tcp)
2024-02-14 19:46:37 DEBUG nx_module_pollset_poll: tcp
2024-02-14 19:46:37 DEBUG [tcp] no poll events, pollset_poll timed out
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: POLL (tcp)
2024-02-14 19:46:37 DEBUG event added to jobqueue
2024-02-14 19:46:37 DEBUG worker 1 got signal for new job
2024-02-14 19:46:37 DEBUG worker 1 processing event 0xa23d47c0
2024-02-14 19:46:37 DEBUG worker 2 waiting for new event
2024-02-14 19:46:37 DEBUG PROCESS_EVENT: POLL (tcp)
2024-02-14 19:46:37 DEBUG nx_module_pollset_poll: tcp
2024-02-14 19:46:37 DEBUG [tcp] no poll events, pollset_poll timed out
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: POLL (tcp)
2024-02-14 19:46:37 DEBUG event added to jobqueue
2024-02-14 19:46:37 DEBUG worker 1 processing event 0xa201b5c0
2024-02-14 19:46:37 DEBUG PROCESS_EVENT: POLL (tcp)
2024-02-14 19:46:37 DEBUG nx_module_pollset_poll: tcp
2024-02-14 19:46:37 DEBUG worker 0 got signal for new job
2024-02-14 19:46:37 DEBUG worker 0 got no event to process
2024-02-14 19:46:37 DEBUG worker 0 waiting for new event
2024-02-14 19:46:37 DEBUG [tcp] no poll events, pollset_poll timed out
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: POLL (tcp)
2024-02-14 19:46:37 DEBUG event added to jobqueue
2024-02-14 19:46:37 DEBUG worker 2 got signal for new job
2024-02-14 19:46:37 DEBUG worker 2 processing event 0xa201b890
2024-02-14 19:46:37 DEBUG worker 1 waiting for new event
2024-02-14 19:46:37 DEBUG PROCESS_EVENT: POLL (tcp)
2024-02-14 19:46:37 DEBUG nx_module_pollset_poll: tcp
2024-02-14 19:46:37 DEBUG [tcp] no poll events, pollset_poll timed out
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: POLL (tcp)
2024-02-14 19:46:37 DEBUG event added to jobqueue
2024-02-14 19:46:37 DEBUG worker 0 got signal for new job
2024-02-14 19:46:37 DEBUG worker 0 processing event 0xa23d49a0
2024-02-14 19:46:37 DEBUG worker 2 waiting for new event
2024-02-14 19:46:37 DEBUG PROCESS_EVENT: POLL (tcp)
2024-02-14 19:46:37 DEBUG nx_module_pollset_poll: tcp
2024-02-14 19:46:37 DEBUG [tcp] no poll events, pollset_poll timed out
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: POLL (tcp)
2024-02-14 19:46:37 DEBUG event added to jobqueue
2024-02-14 19:46:37 DEBUG worker 1 got signal for new job
2024-02-14 19:46:37 DEBUG worker 1 processing event 0xa23d47c0
2024-02-14 19:46:37 DEBUG worker 0 waiting for new event
2024-02-14 19:46:37 DEBUG PROCESS_EVENT: POLL (tcp)
2024-02-14 19:46:37 DEBUG nx_module_pollset_poll: tcp
2024-02-14 19:46:37 DEBUG [tcp] no poll events, pollset_poll timed out
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: POLL (tcp)
2024-02-14 19:46:37 DEBUG event added to jobqueue
2024-02-14 19:46:37 DEBUG worker 2 got signal for new job
2024-02-14 19:46:37 DEBUG worker 1 waiting for new event
2024-02-14 19:46:37 DEBUG worker 2 processing event 0xa201b5c0
2024-02-14 19:46:37 DEBUG PROCESS_EVENT: POLL (tcp)
2024-02-14 19:46:37 DEBUG nx_module_pollset_poll: tcp
2024-02-14 19:46:37 DEBUG [tcp] no poll events, pollset_poll timed out
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: POLL (tcp)
2024-02-14 19:46:37 DEBUG event added to jobqueue
2024-02-14 19:46:37 DEBUG worker 0 got signal for new job
2024-02-14 19:46:37 DEBUG worker 0 processing event 0xa23d4a40
2024-02-14 19:46:37 DEBUG worker 2 waiting for new event
2024-02-14 19:46:37 DEBUG PROCESS_EVENT: POLL (tcp)
2024-02-14 19:46:37 DEBUG nx_module_pollset_poll: tcp
2024-02-14 19:46:37 DEBUG new event in event_thread [eventlog:READ]
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: READ (eventlog)
2024-02-14 19:46:37 DEBUG event added to jobqueue
2024-02-14 19:46:37 DEBUG no events or no future events, event thread sleeping in condwait
2024-02-14 19:46:37 DEBUG worker 1 got signal for new job
2024-02-14 19:46:37 DEBUG worker 1 processing event 0xa201b570
2024-02-14 19:46:37 DEBUG PROCESS_EVENT: READ (eventlog)
2024-02-14 19:46:37 DEBUG im_msvistalog checking for new events...
2024-02-14 19:46:37 DEBUG im_msvistalog read 21 events
2024-02-14 19:46:37 DEBUG before nx_logqueue_push, size: 0
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: DATA_AVAILABLE (tcp)
2024-02-14 19:46:37 DEBUG event added to jobqueue
2024-02-14 19:46:37 DEBUG worker 2 got signal for new job
2024-02-14 19:46:37 DEBUG worker 2 got no event to process
2024-02-14 19:46:37 DEBUG worker 2 waiting for new event
2024-02-14 19:46:37 DEBUG [tcp] apr_pollset_poll was interrupted
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: POLL (tcp)
2024-02-14 19:46:37 DEBUG event added to jobqueue
2024-02-14 19:46:37 DEBUG worker 2 got signal for new job
2024-02-14 19:46:37 DEBUG worker 2 processing event 0xa23d4a90
2024-02-14 19:46:37 DEBUG worker 0 waiting for new event
2024-02-14 19:46:37 DEBUG PROCESS_EVENT: DATA_AVAILABLE (tcp)
2024-02-14 19:46:37 DEBUG om_tcp_write
2024-02-14 19:46:37 DEBUG add socket [21]
2024-02-14 19:46:37 DEBUG socket already added to pollset with reqevents [21 != 21]
2024-02-14 19:46:37 DEBUG tcp get_next_logdata: got (queuesize: 0)
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: DATA_AVAILABLE (tcp)
2024-02-14 19:46:37 DEBUG event added to jobqueue
2024-02-14 19:46:37 DEBUG worker 0 got signal for new job
2024-02-14 19:46:37 DEBUG worker 0 got no event to process
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: MODULE_RESUME (eventlog)
2024-02-14 19:46:37 DEBUG event added to jobqueue
2024-02-14 19:46:37 DEBUG executing statements
2024-02-14 19:46:37 DEBUG worker 0 waiting for new event
2024-02-14 19:46:37 DEBUG evaluating expression 'string literal' at C:\Program Files\nxlog\conf\nxlog.conf:34
2024-02-14 19:46:37 DEBUG om_tcp sent 1292 bytes
2024-02-14 19:46:37 DEBUG before nx_logqueue_pop, size: 1
2024-02-14 19:46:37 DEBUG tcp get_next_logdata: got NULL (queuesize: 0)
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: MODULE_RESUME (eventlog)
2024-02-14 19:46:37 DEBUG before nx_logqueue_push, size: 0
2024-02-14 19:46:37 DEBUG worker 2 processing event 0xa201b840
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: DATA_AVAILABLE (tcp)
2024-02-14 19:46:37 DEBUG PROCESS_EVENT: POLL (tcp)
2024-02-14 19:46:37 DEBUG nx_module_pollset_poll: tcp
2024-02-14 19:46:37 DEBUG found other events (1), adding poll event to end of list
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: POLL (tcp)
2024-02-14 19:46:37 DEBUG event added to jobqueue
2024-02-14 19:46:37 DEBUG worker 0 got signal for new job
2024-02-14 19:46:37 DEBUG worker 0 processing event 0xa201b7a0
2024-02-14 19:46:37 DEBUG PROCESS_EVENT: DATA_AVAILABLE (tcp)
2024-02-14 19:46:37 DEBUG worker 2 waiting for new event
2024-02-14 19:46:37 DEBUG om_tcp_write
2024-02-14 19:46:37 DEBUG add socket [21]
2024-02-14 19:46:37 DEBUG socket already added to pollset with reqevents [21 != 21]
2024-02-14 19:46:37 DEBUG tcp get_next_logdata: got (queuesize: 0)
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: DATA_AVAILABLE (tcp)
2024-02-14 19:46:37 DEBUG event added to jobqueue
2024-02-14 19:46:37 DEBUG worker 2 got signal for new job
2024-02-14 19:46:37 DEBUG worker 2 got no event to process
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: MODULE_RESUME (eventlog)
2024-02-14 19:46:37 DEBUG executing statements
2024-02-14 19:46:37 DEBUG worker 2 waiting for new event
2024-02-14 19:46:37 DEBUG evaluating expression 'string literal' at C:\Program Files\nxlog\conf\nxlog.conf:34
2024-02-14 19:46:37 DEBUG om_tcp sent 1449 bytes
2024-02-14 19:46:37 DEBUG before nx_logqueue_pop, size: 1
2024-02-14 19:46:37 DEBUG tcp get_next_logdata: got NULL (queuesize: 0)
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: MODULE_RESUME (eventlog)
2024-02-14 19:46:37 DEBUG before nx_logqueue_push, size: 0
2024-02-14 19:46:37 DEBUG worker 0 processing event 0xa201b7f0
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: DATA_AVAILABLE (tcp)
2024-02-14 19:46:37 DEBUG PROCESS_EVENT: POLL (tcp)
2024-02-14 19:46:37 DEBUG nx_module_pollset_poll: tcp
2024-02-14 19:46:37 DEBUG found other events (1), adding poll event to end of list
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: POLL (tcp)
2024-02-14 19:46:37 DEBUG event added to jobqueue
2024-02-14 19:46:37 DEBUG worker 2 got signal for new job
2024-02-14 19:46:37 DEBUG worker 2 processing event 0xa23d4770
2024-02-14 19:46:37 DEBUG worker 0 waiting for new event
2024-02-14 19:46:37 DEBUG PROCESS_EVENT: DATA_AVAILABLE (tcp)
2024-02-14 19:46:37 DEBUG om_tcp_write
2024-02-14 19:46:37 DEBUG add socket [21]
2024-02-14 19:46:37 DEBUG socket already added to pollset with reqevents [21 != 21]
2024-02-14 19:46:37 DEBUG tcp get_next_logdata: got (queuesize: 0)
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: DATA_AVAILABLE (tcp)
2024-02-14 19:46:37 DEBUG event added to jobqueue
2024-02-14 19:46:37 DEBUG worker 0 got signal for new job
2024-02-14 19:46:37 DEBUG worker 0 got no event to process
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: MODULE_RESUME (eventlog)
2024-02-14 19:46:37 DEBUG executing statements
2024-02-14 19:46:37 DEBUG worker 0 waiting for new event
2024-02-14 19:46:37 DEBUG evaluating expression 'string literal' at C:\Program Files\nxlog\conf\nxlog.conf:34
2024-02-14 19:46:37 DEBUG om_tcp sent 1292 bytes
2024-02-14 19:46:37 DEBUG before nx_logqueue_pop, size: 1
2024-02-14 19:46:37 DEBUG tcp get_next_logdata: got NULL (queuesize: 0)
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: MODULE_RESUME (eventlog)
2024-02-14 19:46:37 DEBUG before nx_logqueue_push, size: 0
2024-02-14 19:46:37 DEBUG worker 2 processing event 0xa23d4900
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: DATA_AVAILABLE (tcp)
2024-02-14 19:46:37 DEBUG PROCESS_EVENT: POLL (tcp)
2024-02-14 19:46:37 DEBUG nx_module_pollset_poll: tcp
2024-02-14 19:46:37 DEBUG found other events (1), adding poll event to end of list
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: POLL (tcp)
2024-02-14 19:46:37 DEBUG event added to jobqueue
2024-02-14 19:46:37 DEBUG worker 0 got signal for new job
2024-02-14 19:46:37 DEBUG worker 0 processing event 0xa201b7a0
2024-02-14 19:46:37 DEBUG worker 2 waiting for new event
2024-02-14 19:46:37 DEBUG PROCESS_EVENT: DATA_AVAILABLE (tcp)
2024-02-14 19:46:37 DEBUG om_tcp_write
2024-02-14 19:46:37 DEBUG add socket [21]
2024-02-14 19:46:37 DEBUG socket already added to pollset with reqevents [21 != 21]
2024-02-14 19:46:37 DEBUG tcp get_next_logdata: got (queuesize: 0)
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: DATA_AVAILABLE (tcp)
2024-02-14 19:46:37 DEBUG event added to jobqueue
2024-02-14 19:46:37 DEBUG worker 2 got signal for new job
2024-02-14 19:46:37 DEBUG worker 2 got no event to process
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: MODULE_RESUME (eventlog)
2024-02-14 19:46:37 DEBUG executing statements
2024-02-14 19:46:37 DEBUG worker 2 waiting for new event
2024-02-14 19:46:37 DEBUG evaluating expression 'string literal' at C:\Program Files\nxlog\conf\nxlog.conf:34
2024-02-14 19:46:37 DEBUG om_tcp sent 1292 bytes
2024-02-14 19:46:37 DEBUG before nx_logqueue_pop, size: 1
2024-02-14 19:46:37 DEBUG before nx_logqueue_push, size: 0
2024-02-14 19:46:37 DEBUG tcp get_next_logdata: got (queuesize: 0)
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: DATA_AVAILABLE (tcp)
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: DATA_AVAILABLE (tcp)
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: MODULE_RESUME (eventlog)
2024-02-14 19:46:37 DEBUG executing statements
2024-02-14 19:46:37 DEBUG evaluating expression 'string literal' at C:\Program Files\nxlog\conf\nxlog.conf:34
2024-02-14 19:46:37 DEBUG om_tcp sent 1292 bytes
2024-02-14 19:46:37 DEBUG before nx_logqueue_pop, size: 1
2024-02-14 19:46:37 DEBUG tcp get_next_logdata: got NULL (queuesize: 0)
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: MODULE_RESUME (eventlog)
2024-02-14 19:46:37 DEBUG worker 0 processing event 0xa201b5c0
2024-02-14 19:46:37 DEBUG PROCESS_EVENT: POLL (tcp)
2024-02-14 19:46:37 DEBUG nx_module_pollset_poll: tcp
2024-02-14 19:46:37 DEBUG found other events (1), adding poll event to end of list
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: POLL (tcp)
2024-02-14 19:46:37 DEBUG event added to jobqueue
2024-02-14 19:46:37 DEBUG worker 2 got signal for new job
2024-02-14 19:46:37 DEBUG worker 2 processing event 0xa23d4810
2024-02-14 19:46:37 DEBUG worker 0 waiting for new event
2024-02-14 19:46:37 DEBUG PROCESS_EVENT: DATA_AVAILABLE (tcp)
2024-02-14 19:46:37 DEBUG om_tcp_write
2024-02-14 19:46:37 DEBUG add socket [21]
2024-02-14 19:46:37 DEBUG before nx_logqueue_push, size: 0
2024-02-14 19:46:37 DEBUG socket already added to pollset with reqevents [21 != 21]
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: DATA_AVAILABLE (tcp)
2024-02-14 19:46:37 DEBUG tcp get_next_logdata: got (queuesize: 0)
2024-02-14 19:46:37 DEBUG event added to jobqueue
2024-02-14 19:46:37 DEBUG worker 0 got signal for new job
2024-02-14 19:46:37 DEBUG worker 0 got no event to process
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: DATA_AVAILABLE (tcp)
2024-02-14 19:46:37 DEBUG worker 0 waiting for new event
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: MODULE_RESUME (eventlog)
2024-02-14 19:46:37 DEBUG executing statements
2024-02-14 19:46:37 DEBUG evaluating expression 'string literal' at C:\Program Files\nxlog\conf\nxlog.conf:34
2024-02-14 19:46:37 DEBUG before nx_logqueue_push, size: 1
2024-02-14 19:46:37 DEBUG om_tcp sent 1292 bytes
2024-02-14 19:46:37 DEBUG before nx_logqueue_pop, size: 2
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: DATA_AVAILABLE (tcp)
2024-02-14 19:46:37 DEBUG tcp get_next_logdata: got (queuesize: 0)
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: DATA_AVAILABLE (tcp)
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: MODULE_RESUME (eventlog)
2024-02-14 19:46:37 DEBUG executing statements
2024-02-14 19:46:37 DEBUG evaluating expression 'string literal' at C:\Program Files\nxlog\conf\nxlog.conf:34
2024-02-14 19:46:37 DEBUG om_tcp sent 1292 bytes
2024-02-14 19:46:37 DEBUG before nx_logqueue_pop, size: 1
2024-02-14 19:46:37 DEBUG tcp get_next_logdata: got NULL (queuesize: 0)
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: MODULE_RESUME (eventlog)
2024-02-14 19:46:37 DEBUG worker 2 processing event 0xa23d4860
2024-02-14 19:46:37 DEBUG PROCESS_EVENT: POLL (tcp)
2024-02-14 19:46:37 DEBUG nx_module_pollset_poll: tcp
2024-02-14 19:46:37 DEBUG found other events (1), adding poll event to end of list
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: POLL (tcp)
2024-02-14 19:46:37 DEBUG event added to jobqueue
2024-02-14 19:46:37 DEBUG before nx_logqueue_push, size: 0
2024-02-14 19:46:37 DEBUG worker 0 got signal for new job
2024-02-14 19:46:37 DEBUG worker 0 processing event 0xa201b610
2024-02-14 19:46:37 DEBUG worker 2 waiting for new event
2024-02-14 19:46:37 DEBUG PROCESS_EVENT: DATA_AVAILABLE (tcp)
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: DATA_AVAILABLE (tcp)
2024-02-14 19:46:37 DEBUG om_tcp_write
2024-02-14 19:46:37 DEBUG event added to jobqueue
2024-02-14 19:46:37 DEBUG add socket [21]
2024-02-14 19:46:37 DEBUG worker 2 got signal for new job
2024-02-14 19:46:37 DEBUG socket already added to pollset with reqevents [21 != 21]
2024-02-14 19:46:37 DEBUG worker 2 got no event to process
2024-02-14 19:46:37 DEBUG tcp get_next_logdata: got (queuesize: 0)
2024-02-14 19:46:37 DEBUG worker 2 waiting for new event
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: DATA_AVAILABLE (tcp)
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: MODULE_RESUME (eventlog)
2024-02-14 19:46:37 DEBUG executing statements
2024-02-14 19:46:37 DEBUG evaluating expression 'string literal' at C:\Program Files\nxlog\conf\nxlog.conf:34
2024-02-14 19:46:37 DEBUG om_tcp sent 1292 bytes
2024-02-14 19:46:37 DEBUG before nx_logqueue_pop, size: 1
2024-02-14 19:46:37 DEBUG tcp get_next_logdata: got NULL (queuesize: 0)
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: MODULE_RESUME (eventlog)
2024-02-14 19:46:37 DEBUG worker 0 processing event 0xa201b660
2024-02-14 19:46:37 DEBUG PROCESS_EVENT: POLL (tcp)
2024-02-14 19:46:37 DEBUG nx_module_pollset_poll: tcp
2024-02-14 19:46:37 DEBUG found other events (1), adding poll event to end of list
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: POLL (tcp)
2024-02-14 19:46:37 DEBUG event added to jobqueue
2024-02-14 19:46:37 DEBUG worker 2 got signal for new job
2024-02-14 19:46:37 DEBUG worker 2 processing event 0xa23d4950
2024-02-14 19:46:37 DEBUG PROCESS_EVENT: DATA_AVAILABLE (tcp)
2024-02-14 19:46:37 DEBUG worker 0 waiting for new event
2024-02-14 19:46:37 DEBUG om_tcp_write
2024-02-14 19:46:37 DEBUG add socket [21]
2024-02-14 19:46:37 DEBUG socket already added to pollset with reqevents [21 != 21]
2024-02-14 19:46:37 DEBUG tcp get_next_logdata: got NULL (queuesize: 0)
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: MODULE_RESUME (eventlog)
2024-02-14 19:46:37 DEBUG worker 2 processing event 0xa201b610
2024-02-14 19:46:37 DEBUG PROCESS_EVENT: POLL (tcp)
2024-02-14 19:46:37 DEBUG nx_module_pollset_poll: tcp
2024-02-14 19:46:37 DEBUG before nx_logqueue_push, size: 0
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: DATA_AVAILABLE (tcp)
2024-02-14 19:46:37 DEBUG event added to jobqueue
2024-02-14 19:46:37 DEBUG worker 0 got signal for new job
2024-02-14 19:46:37 DEBUG worker 0 got no event to process
2024-02-14 19:46:37 DEBUG worker 0 waiting for new event
2024-02-14 19:46:37 DEBUG [tcp] apr_pollset_poll was interrupted
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: POLL (tcp)
2024-02-14 19:46:37 DEBUG event added to jobqueue
2024-02-14 19:46:37 DEBUG worker 0 got signal for new job
2024-02-14 19:46:37 DEBUG worker 0 processing event 0xa201b5c0
2024-02-14 19:46:37 DEBUG worker 2 waiting for new event
2024-02-14 19:46:37 DEBUG PROCESS_EVENT: DATA_AVAILABLE (tcp)
2024-02-14 19:46:37 DEBUG om_tcp_write
2024-02-14 19:46:37 DEBUG add socket [21]
2024-02-14 19:46:37 DEBUG socket already added to pollset with reqevents [21 != 21]
2024-02-14 19:46:37 DEBUG tcp get_next_logdata: got (queuesize: 0)
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: DATA_AVAILABLE (tcp)
2024-02-14 19:46:37 DEBUG event added to jobqueue
2024-02-14 19:46:37 DEBUG worker 2 got signal for new job
2024-02-14 19:46:37 DEBUG worker 2 got no event to process
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: MODULE_RESUME (eventlog)
2024-02-14 19:46:37 DEBUG executing statements
2024-02-14 19:46:37 DEBUG worker 2 waiting for new event
2024-02-14 19:46:37 DEBUG evaluating expression 'string literal' at C:\Program Files\nxlog\conf\nxlog.conf:34
2024-02-14 19:46:37 DEBUG om_tcp sent 1292 bytes
2024-02-14 19:46:37 DEBUG before nx_logqueue_pop, size: 1
2024-02-14 19:46:37 DEBUG tcp get_next_logdata: got NULL (queuesize: 0)
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: MODULE_RESUME (eventlog)
2024-02-14 19:46:37 DEBUG before nx_logqueue_push, size: 0
2024-02-14 19:46:37 DEBUG worker 0 processing event 0xa23d47c0
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: DATA_AVAILABLE (tcp)
2024-02-14 19:46:37 DEBUG PROCESS_EVENT: POLL (tcp)
2024-02-14 19:46:37 DEBUG nx_module_pollset_poll: tcp
2024-02-14 19:46:37 DEBUG found other events (1), adding poll event to end of list
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: POLL (tcp)
2024-02-14 19:46:37 DEBUG event added to jobqueue
2024-02-14 19:46:37 DEBUG worker 2 got signal for new job
2024-02-14 19:46:37 DEBUG worker 2 processing event 0xa23d4900
2024-02-14 19:46:37 DEBUG worker 0 waiting for new event
2024-02-14 19:46:37 DEBUG PROCESS_EVENT: DATA_AVAILABLE (tcp)
2024-02-14 19:46:37 DEBUG om_tcp_write
2024-02-14 19:46:37 DEBUG add socket [21]
2024-02-14 19:46:37 DEBUG socket already added to pollset with reqevents [21 != 21]
2024-02-14 19:46:37 DEBUG tcp get_next_logdata: got (queuesize: 0)
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: DATA_AVAILABLE (tcp)
2024-02-14 19:46:37 DEBUG event added to jobqueue
2024-02-14 19:46:37 DEBUG worker 0 got signal for new job
2024-02-14 19:46:37 DEBUG worker 0 got no event to process
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: MODULE_RESUME (eventlog)
2024-02-14 19:46:37 DEBUG executing statements
2024-02-14 19:46:37 DEBUG worker 0 waiting for new event
2024-02-14 19:46:37 DEBUG evaluating expression 'string literal' at C:\Program Files\nxlog\conf\nxlog.conf:34
2024-02-14 19:46:37 DEBUG om_tcp sent 1479 bytes
2024-02-14 19:46:37 DEBUG before nx_logqueue_pop, size: 1
2024-02-14 19:46:37 DEBUG before nx_logqueue_push, size: 0
2024-02-14 19:46:37 DEBUG tcp get_next_logdata: got (queuesize: 0)
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: DATA_AVAILABLE (tcp)
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: DATA_AVAILABLE (tcp)
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: MODULE_RESUME (eventlog)
2024-02-14 19:46:37 DEBUG executing statements
2024-02-14 19:46:37 DEBUG evaluating expression 'string literal' at C:\Program Files\nxlog\conf\nxlog.conf:34
2024-02-14 19:46:37 DEBUG om_tcp sent 1292 bytes
2024-02-14 19:46:37 DEBUG before nx_logqueue_pop, size: 1
2024-02-14 19:46:37 DEBUG tcp get_next_logdata: got NULL (queuesize: 0)
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: MODULE_RESUME (eventlog)
2024-02-14 19:46:37 DEBUG worker 2 processing event 0xa23d4810
2024-02-14 19:46:37 DEBUG PROCESS_EVENT: POLL (tcp)
2024-02-14 19:46:37 DEBUG nx_module_pollset_poll: tcp
2024-02-14 19:46:37 DEBUG found other events (1), adding poll event to end of list
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: POLL (tcp)
2024-02-14 19:46:37 DEBUG before nx_logqueue_push, size: 0
2024-02-14 19:46:37 DEBUG event added to jobqueue
2024-02-14 19:46:37 DEBUG worker 0 got signal for new job
2024-02-14 19:46:37 DEBUG worker 0 processing event 0xa201b700
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: DATA_AVAILABLE (tcp)
2024-02-14 19:46:37 DEBUG PROCESS_EVENT: DATA_AVAILABLE (tcp)
2024-02-14 19:46:37 DEBUG event added to jobqueue
2024-02-14 19:46:37 DEBUG om_tcp_write
2024-02-14 19:46:37 DEBUG worker 2 waiting for new event
2024-02-14 19:46:37 DEBUG add socket [21]
2024-02-14 19:46:37 DEBUG socket already added to pollset with reqevents [21 != 21]
2024-02-14 19:46:37 DEBUG tcp get_next_logdata: got (queuesize: 0)
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: DATA_AVAILABLE (tcp)
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: MODULE_RESUME (eventlog)
2024-02-14 19:46:37 DEBUG executing statements
2024-02-14 19:46:37 DEBUG evaluating expression 'string literal' at C:\Program Files\nxlog\conf\nxlog.conf:34
2024-02-14 19:46:37 DEBUG om_tcp sent 1883 bytes
2024-02-14 19:46:37 DEBUG before nx_logqueue_pop, size: 1
2024-02-14 19:46:37 DEBUG tcp get_next_logdata: got NULL (queuesize: 0)
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: MODULE_RESUME (eventlog)
2024-02-14 19:46:37 DEBUG worker 0 processing event 0xa201b840
2024-02-14 19:46:37 DEBUG PROCESS_EVENT: POLL (tcp)
2024-02-14 19:46:37 DEBUG nx_module_pollset_poll: tcp
2024-02-14 19:46:37 DEBUG found other events (1), adding poll event to end of list
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: POLL (tcp)
2024-02-14 19:46:37 DEBUG event added to jobqueue
2024-02-14 19:46:37 DEBUG worker 2 got signal for new job
2024-02-14 19:46:37 DEBUG before nx_logqueue_push, size: 0
2024-02-14 19:46:37 DEBUG worker 2 processing event 0xa23d49f0
2024-02-14 19:46:37 DEBUG worker 0 waiting for new event
2024-02-14 19:46:37 DEBUG PROCESS_EVENT: DATA_AVAILABLE (tcp)
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: DATA_AVAILABLE (tcp)
2024-02-14 19:46:37 DEBUG om_tcp_write
2024-02-14 19:46:37 DEBUG event added to jobqueue
2024-02-14 19:46:37 DEBUG add socket [21]
2024-02-14 19:46:37 DEBUG worker 0 got signal for new job
2024-02-14 19:46:37 DEBUG socket already added to pollset with reqevents [21 != 21]
2024-02-14 19:46:37 DEBUG worker 0 got no event to process
2024-02-14 19:46:37 DEBUG tcp get_next_logdata: got (queuesize: 0)
2024-02-14 19:46:37 DEBUG worker 0 waiting for new event
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: DATA_AVAILABLE (tcp)
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: MODULE_RESUME (eventlog)
2024-02-14 19:46:37 DEBUG executing statements
2024-02-14 19:46:37 DEBUG evaluating expression 'string literal' at C:\Program Files\nxlog\conf\nxlog.conf:34
2024-02-14 19:46:37 DEBUG om_tcp sent 1843 bytes
2024-02-14 19:46:37 DEBUG before nx_logqueue_pop, size: 1
2024-02-14 19:46:37 DEBUG tcp get_next_logdata: got NULL (queuesize: 0)
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: MODULE_RESUME (eventlog)
2024-02-14 19:46:37 DEBUG worker 2 processing event 0xa23d47c0
2024-02-14 19:46:37 DEBUG PROCESS_EVENT: POLL (tcp)
2024-02-14 19:46:37 DEBUG nx_module_pollset_poll: tcp
2024-02-14 19:46:37 DEBUG found other events (1), adding poll event to end of list
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: POLL (tcp)
2024-02-14 19:46:37 DEBUG event added to jobqueue
2024-02-14 19:46:37 DEBUG worker 0 got signal for new job
2024-02-14 19:46:37 DEBUG worker 0 processing event 0xa201b7a0
2024-02-14 19:46:37 DEBUG worker 2 waiting for new event
2024-02-14 19:46:37 DEBUG PROCESS_EVENT: DATA_AVAILABLE (tcp)
2024-02-14 19:46:37 DEBUG om_tcp_write
2024-02-14 19:46:37 DEBUG add socket [21]
2024-02-14 19:46:37 DEBUG before nx_logqueue_push, size: 0
2024-02-14 19:46:37 DEBUG socket already added to pollset with reqevents [21 != 21]
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: DATA_AVAILABLE (tcp)
2024-02-14 19:46:37 DEBUG tcp get_next_logdata: got (queuesize: 0)
2024-02-14 19:46:37 DEBUG event added to jobqueue
2024-02-14 19:46:37 DEBUG worker 2 got signal for new job
2024-02-14 19:46:37 DEBUG worker 2 got no event to process
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: DATA_AVAILABLE (tcp)
2024-02-14 19:46:37 DEBUG worker 2 waiting for new event
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: MODULE_RESUME (eventlog)
2024-02-14 19:46:37 DEBUG executing statements
2024-02-14 19:46:37 DEBUG evaluating expression 'string literal' at C:\Program Files\nxlog\conf\nxlog.conf:34
2024-02-14 19:46:37 DEBUG om_tcp sent 2011 bytes
2024-02-14 19:46:37 DEBUG before nx_logqueue_pop, size: 1
2024-02-14 19:46:37 DEBUG tcp get_next_logdata: got NULL (queuesize: 0)
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: MODULE_RESUME (eventlog)
2024-02-14 19:46:37 DEBUG worker 0 processing event 0xa23d4770
2024-02-14 19:46:37 DEBUG PROCESS_EVENT: POLL (tcp)
2024-02-14 19:46:37 DEBUG nx_module_pollset_poll: tcp
2024-02-14 19:46:37 DEBUG found other events (1), adding poll event to end of list
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: POLL (tcp)
2024-02-14 19:46:37 DEBUG event added to jobqueue
2024-02-14 19:46:37 DEBUG worker 2 got signal for new job
2024-02-14 19:46:37 DEBUG worker 2 processing event 0xa201b5c0
2024-02-14 19:46:37 DEBUG worker 0 waiting for new event
2024-02-14 19:46:37 DEBUG PROCESS_EVENT: DATA_AVAILABLE (tcp)
2024-02-14 19:46:37 DEBUG before nx_logqueue_push, size: 0
2024-02-14 19:46:37 DEBUG om_tcp_write
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: DATA_AVAILABLE (tcp)
2024-02-14 19:46:37 DEBUG add socket [21]
2024-02-14 19:46:37 DEBUG event added to jobqueue
2024-02-14 19:46:37 DEBUG socket already added to pollset with reqevents [21 != 21]
2024-02-14 19:46:37 DEBUG worker 0 got signal for new job
2024-02-14 19:46:37 DEBUG tcp get_next_logdata: got (queuesize: 0)
2024-02-14 19:46:37 DEBUG worker 0 got no event to process
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: DATA_AVAILABLE (tcp)
2024-02-14 19:46:37 DEBUG worker 0 waiting for new event
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: MODULE_RESUME (eventlog)
2024-02-14 19:46:37 DEBUG executing statements
2024-02-14 19:46:37 DEBUG evaluating expression 'string literal' at C:\Program Files\nxlog\conf\nxlog.conf:34
2024-02-14 19:46:37 DEBUG om_tcp sent 2019 bytes
2024-02-14 19:46:37 DEBUG before nx_logqueue_pop, size: 1
2024-02-14 19:46:37 DEBUG tcp get_next_logdata: got NULL (queuesize: 0)
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: MODULE_RESUME (eventlog)
2024-02-14 19:46:37 DEBUG worker 2 processing event 0xa201b660
2024-02-14 19:46:37 DEBUG PROCESS_EVENT: POLL (tcp)
2024-02-14 19:46:37 DEBUG nx_module_pollset_poll: tcp
2024-02-14 19:46:37 DEBUG found other events (1), adding poll event to end of list
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: POLL (tcp)
2024-02-14 19:46:37 DEBUG before nx_logqueue_push, size: 0
2024-02-14 19:46:37 DEBUG event added to jobqueue
2024-02-14 19:46:37 DEBUG worker 0 got signal for new job
2024-02-14 19:46:37 DEBUG worker 0 processing event 0xa23d4900
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: DATA_AVAILABLE (tcp)
2024-02-14 19:46:37 DEBUG PROCESS_EVENT: DATA_AVAILABLE (tcp)
2024-02-14 19:46:37 DEBUG event added to jobqueue
2024-02-14 19:46:37 DEBUG om_tcp_write
2024-02-14 19:46:37 DEBUG worker 2 waiting for new event
2024-02-14 19:46:37 DEBUG add socket [21]
2024-02-14 19:46:37 DEBUG socket already added to pollset with reqevents [21 != 21]
2024-02-14 19:46:37 DEBUG tcp get_next_logdata: got (queuesize: 0)
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: DATA_AVAILABLE (tcp)
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: MODULE_RESUME (eventlog)
2024-02-14 19:46:37 DEBUG executing statements
2024-02-14 19:46:37 DEBUG evaluating expression 'string literal' at C:\Program Files\nxlog\conf\nxlog.conf:34
2024-02-14 19:46:37 DEBUG om_tcp sent 1769 bytes
2024-02-14 19:46:37 DEBUG before nx_logqueue_pop, size: 1
2024-02-14 19:46:37 DEBUG tcp get_next_logdata: got NULL (queuesize: 0)
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: MODULE_RESUME (eventlog)
2024-02-14 19:46:37 DEBUG worker 0 processing event 0xa201b890
2024-02-14 19:46:37 DEBUG PROCESS_EVENT: POLL (tcp)
2024-02-14 19:46:37 DEBUG nx_module_pollset_poll: tcp
2024-02-14 19:46:37 DEBUG found other events (1), adding poll event to end of list
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: POLL (tcp)
2024-02-14 19:46:37 DEBUG event added to jobqueue
2024-02-14 19:46:37 DEBUG worker 2 got signal for new job
2024-02-14 19:46:37 DEBUG before nx_logqueue_push, size: 0
2024-02-14 19:46:37 DEBUG worker 2 processing event 0xa23d4a90
2024-02-14 19:46:37 DEBUG PROCESS_EVENT: DATA_AVAILABLE (tcp)
2024-02-14 19:46:37 DEBUG worker 0 waiting for new event
2024-02-14 19:46:37 DEBUG om_tcp_write
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: DATA_AVAILABLE (tcp)
2024-02-14 19:46:37 DEBUG add socket [21]
2024-02-14 19:46:37 DEBUG event added to jobqueue
2024-02-14 19:46:37 DEBUG socket already added to pollset with reqevents [21 != 21]
2024-02-14 19:46:37 DEBUG worker 0 got signal for new job
2024-02-14 19:46:37 DEBUG tcp get_next_logdata: got (queuesize: 0)
2024-02-14 19:46:37 DEBUG worker 0 got no event to process
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: DATA_AVAILABLE (tcp)
2024-02-14 19:46:37 DEBUG worker 0 waiting for new event
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: MODULE_RESUME (eventlog)
2024-02-14 19:46:37 DEBUG executing statements
2024-02-14 19:46:37 DEBUG evaluating expression 'string literal' at C:\Program Files\nxlog\conf\nxlog.conf:34
2024-02-14 19:46:37 DEBUG om_tcp sent 1800 bytes
2024-02-14 19:46:37 DEBUG before nx_logqueue_pop, size: 1
2024-02-14 19:46:37 DEBUG tcp get_next_logdata: got NULL (queuesize: 0)
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: MODULE_RESUME (eventlog)
2024-02-14 19:46:37 DEBUG worker 2 processing event 0xa23d48b0
2024-02-14 19:46:37 DEBUG PROCESS_EVENT: POLL (tcp)
2024-02-14 19:46:37 DEBUG nx_module_pollset_poll: tcp
2024-02-14 19:46:37 DEBUG found other events (1), adding poll event to end of list
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: POLL (tcp)
2024-02-14 19:46:37 DEBUG event added to jobqueue
2024-02-14 19:46:37 DEBUG worker 0 got signal for new job
2024-02-14 19:46:37 DEBUG worker 0 processing event 0xa201b5c0
2024-02-14 19:46:37 DEBUG worker 2 waiting for new event
2024-02-14 19:46:37 DEBUG PROCESS_EVENT: DATA_AVAILABLE (tcp)
2024-02-14 19:46:37 DEBUG om_tcp_write
2024-02-14 19:46:37 DEBUG add socket [21]
2024-02-14 19:46:37 DEBUG socket already added to pollset with reqevents [21 != 21]
2024-02-14 19:46:37 DEBUG tcp get_next_logdata: got NULL (queuesize: 0)
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: MODULE_RESUME (eventlog)
2024-02-14 19:46:37 DEBUG worker 0 processing event 0xa23d4a40
2024-02-14 19:46:37 DEBUG PROCESS_EVENT: POLL (tcp)
2024-02-14 19:46:37 DEBUG nx_module_pollset_poll: tcp
2024-02-14 19:46:37 DEBUG before nx_logqueue_push, size: 0
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: DATA_AVAILABLE (tcp)
2024-02-14 19:46:37 DEBUG event added to jobqueue
2024-02-14 19:46:37 DEBUG worker 2 got signal for new job
2024-02-14 19:46:37 DEBUG worker 2 got no event to process
2024-02-14 19:46:37 DEBUG [tcp] apr_pollset_poll was interrupted
2024-02-14 19:46:37 DEBUG worker 2 waiting for new event
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: POLL (tcp)
2024-02-14 19:46:37 DEBUG event added to jobqueue
2024-02-14 19:46:37 DEBUG worker 2 got signal for new job
2024-02-14 19:46:37 DEBUG worker 2 processing event 0xa23d49a0
2024-02-14 19:46:37 DEBUG worker 0 waiting for new event
2024-02-14 19:46:37 DEBUG PROCESS_EVENT: DATA_AVAILABLE (tcp)
2024-02-14 19:46:37 DEBUG om_tcp_write
2024-02-14 19:46:37 DEBUG add socket [21]
2024-02-14 19:46:37 DEBUG socket already added to pollset with reqevents [21 != 21]
2024-02-14 19:46:37 DEBUG tcp get_next_logdata: got (queuesize: 0)
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: DATA_AVAILABLE (tcp)
2024-02-14 19:46:37 DEBUG event added to jobqueue
2024-02-14 19:46:37 DEBUG worker 0 got signal for new job
2024-02-14 19:46:37 DEBUG worker 0 got no event to process
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: MODULE_RESUME (eventlog)
2024-02-14 19:46:37 DEBUG executing statements
2024-02-14 19:46:37 DEBUG worker 0 waiting for new event
2024-02-14 19:46:37 DEBUG evaluating expression 'string literal' at C:\Program Files\nxlog\conf\nxlog.conf:34
2024-02-14 19:46:37 DEBUG before nx_logqueue_push, size: 1
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: DATA_AVAILABLE (tcp)
2024-02-14 19:46:37 DEBUG om_tcp sent 8161 bytes
2024-02-14 19:46:37 DEBUG before nx_logqueue_pop, size: 2
2024-02-14 19:46:37 DEBUG tcp get_next_logdata: got (queuesize: 0)
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: DATA_AVAILABLE (tcp)
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: MODULE_RESUME (eventlog)
2024-02-14 19:46:37 DEBUG executing statements
2024-02-14 19:46:37 DEBUG evaluating expression 'string literal' at C:\Program Files\nxlog\conf\nxlog.conf:34
2024-02-14 19:46:37 DEBUG om_tcp sent 1843 bytes
2024-02-14 19:46:37 DEBUG before nx_logqueue_pop, size: 1
2024-02-14 19:46:37 DEBUG tcp get_next_logdata: got NULL (queuesize: 0)
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: MODULE_RESUME (eventlog)
2024-02-14 19:46:37 DEBUG worker 2 processing event 0xa201b610
2024-02-14 19:46:37 DEBUG PROCESS_EVENT: POLL (tcp)
2024-02-14 19:46:37 DEBUG nx_module_pollset_poll: tcp
2024-02-14 19:46:37 DEBUG found other events (1), adding poll event to end of list
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: POLL (tcp)
2024-02-14 19:46:37 DEBUG event added to jobqueue
2024-02-14 19:46:37 DEBUG worker 0 got signal for new job
2024-02-14 19:46:37 DEBUG worker 0 processing event 0xa23d4950
2024-02-14 19:46:37 DEBUG PROCESS_EVENT: DATA_AVAILABLE (tcp)
2024-02-14 19:46:37 DEBUG worker 2 waiting for new event
2024-02-14 19:46:37 DEBUG om_tcp_write
2024-02-14 19:46:37 DEBUG add socket [21]
2024-02-14 19:46:37 DEBUG before nx_logqueue_push, size: 0
2024-02-14 19:46:37 DEBUG socket already added to pollset with reqevents [21 != 21]
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: DATA_AVAILABLE (tcp)
2024-02-14 19:46:37 DEBUG tcp get_next_logdata: got (queuesize: 0)
2024-02-14 19:46:37 DEBUG event added to jobqueue
2024-02-14 19:46:37 DEBUG worker 2 got signal for new job
2024-02-14 19:46:37 DEBUG worker 2 got no event to process
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: DATA_AVAILABLE (tcp)
2024-02-14 19:46:37 DEBUG worker 2 waiting for new event
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: MODULE_RESUME (eventlog)
2024-02-14 19:46:37 DEBUG executing statements
2024-02-14 19:46:37 DEBUG evaluating expression 'string literal' at C:\Program Files\nxlog\conf\nxlog.conf:34
2024-02-14 19:46:37 DEBUG om_tcp sent 2025 bytes
2024-02-14 19:46:37 DEBUG before nx_logqueue_pop, size: 1
2024-02-14 19:46:37 DEBUG tcp get_next_logdata: got NULL (queuesize: 0)
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: MODULE_RESUME (eventlog)
2024-02-14 19:46:37 DEBUG worker 0 processing event 0xa23d47c0
2024-02-14 19:46:37 DEBUG PROCESS_EVENT: POLL (tcp)
2024-02-14 19:46:37 DEBUG nx_module_pollset_poll: tcp
2024-02-14 19:46:37 DEBUG found other events (1), adding poll event to end of list
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: POLL (tcp)
2024-02-14 19:46:37 DEBUG event added to jobqueue
2024-02-14 19:46:37 DEBUG worker 2 got signal for new job
2024-02-14 19:46:37 DEBUG worker 2 processing event 0xa201b840
2024-02-14 19:46:37 DEBUG worker 0 waiting for new event
2024-02-14 19:46:37 DEBUG PROCESS_EVENT: DATA_AVAILABLE (tcp)
2024-02-14 19:46:37 DEBUG om_tcp_write
2024-02-14 19:46:37 DEBUG add socket [21]
2024-02-14 19:46:37 DEBUG socket already added to pollset with reqevents [21 != 21]
2024-02-14 19:46:37 DEBUG tcp get_next_logdata: got NULL (queuesize: 0)
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: MODULE_RESUME (eventlog)
2024-02-14 19:46:37 DEBUG worker 2 processing event 0xa201b610
2024-02-14 19:46:37 DEBUG PROCESS_EVENT: POLL (tcp)
2024-02-14 19:46:37 DEBUG nx_module_pollset_poll: tcp
2024-02-14 19:46:37 DEBUG before nx_logqueue_push, size: 0
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: DATA_AVAILABLE (tcp)
2024-02-14 19:46:37 DEBUG event added to jobqueue
2024-02-14 19:46:37 DEBUG worker 0 got signal for new job
2024-02-14 19:46:37 DEBUG worker 0 got no event to process
2024-02-14 19:46:37 DEBUG worker 0 waiting for new event
2024-02-14 19:46:37 DEBUG [tcp] apr_pollset_poll was interrupted
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: POLL (tcp)
2024-02-14 19:46:37 DEBUG event added to jobqueue
2024-02-14 19:46:37 DEBUG worker 1 processing event 0xa23d03f0
2024-02-14 19:46:37 DEBUG worker 0 got signal for new job
2024-02-14 19:46:37 DEBUG PROCESS_EVENT: DATA_AVAILABLE (tcp)
2024-02-14 19:46:37 DEBUG om_tcp_write
2024-02-14 19:46:37 DEBUG worker 0 processing event 0xa201b750
2024-02-14 19:46:37 DEBUG add socket [21]
2024-02-14 19:46:37 DEBUG worker 2 waiting for new event
2024-02-14 19:46:37 DEBUG socket already added to pollset with reqevents [21 != 21]
2024-02-14 19:46:37 DEBUG PROCESS_EVENT: MODULE_RESUME (eventlog)
2024-02-14 19:46:37 DEBUG tcp get_next_logdata: got (queuesize: 0)
2024-02-14 19:46:37 DEBUG RESUME: eventlog
2024-02-14 19:46:37 DEBUG new event in event_thread [eventlog:READ]
2024-02-14 19:46:37 DEBUG module eventlog already running, skipping resume
2024-02-14 19:46:37 DEBUG future event, event thread sleeping 1000000ms in cond_timedwait
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: DATA_AVAILABLE (tcp)
2024-02-14 19:46:37 DEBUG event added to jobqueue
2024-02-14 19:46:37 DEBUG worker 0 waiting for new event
2024-02-14 19:46:37 DEBUG worker 2 got signal for new job
2024-02-14 19:46:37 DEBUG worker 2 got no event to process
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: MODULE_RESUME (eventlog)
2024-02-14 19:46:37 DEBUG event added to jobqueue
2024-02-14 19:46:37 DEBUG executing statements
2024-02-14 19:46:37 DEBUG worker 2 processing event 0xa23d0580
2024-02-14 19:46:37 DEBUG evaluating expression 'string literal' at C:\Program Files\nxlog\conf\nxlog.conf:34
2024-02-14 19:46:37 DEBUG worker 0 got signal for new job
2024-02-14 19:46:37 DEBUG PROCESS_EVENT: MODULE_RESUME (eventlog)
2024-02-14 19:46:37 DEBUG worker 0 got no event to process
2024-02-14 19:46:37 DEBUG RESUME: eventlog
2024-02-14 19:46:37 DEBUG worker 0 waiting for new event
2024-02-14 19:46:37 DEBUG module eventlog already running, skipping resume
2024-02-14 19:46:37 DEBUG worker 2 waiting for new event
2024-02-14 19:46:37 DEBUG om_tcp sent 1985 bytes
2024-02-14 19:46:37 DEBUG before nx_logqueue_pop, size: 1
2024-02-14 19:46:37 DEBUG tcp get_next_logdata: got NULL (queuesize: 0)
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: MODULE_RESUME (eventlog)
2024-02-14 19:46:37 DEBUG event added to jobqueue
2024-02-14 19:46:37 DEBUG worker 0 got signal for new job
2024-02-14 19:46:37 DEBUG worker 0 processing event 0xa23d04e0
2024-02-14 19:46:37 DEBUG PROCESS_EVENT: MODULE_RESUME (eventlog)
2024-02-14 19:46:37 DEBUG RESUME: eventlog
2024-02-14 19:46:37 DEBUG module eventlog already running, skipping resume
2024-02-14 19:46:37 DEBUG worker 0 waiting for new event
2024-02-14 19:46:37 DEBUG worker 1 processing event 0xa201b7f0
2024-02-14 19:46:37 DEBUG PROCESS_EVENT: POLL (tcp)
2024-02-14 19:46:37 DEBUG nx_module_pollset_poll: tcp
2024-02-14 19:46:37 DEBUG found other events (1), adding poll event to end of list
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: POLL (tcp)
2024-02-14 19:46:37 DEBUG event added to jobqueue
2024-02-14 19:46:37 DEBUG worker 2 got signal for new job
2024-02-14 19:46:37 DEBUG worker 2 got no event to process
2024-02-14 19:46:37 DEBUG worker 2 waiting for new event
2024-02-14 19:46:37 DEBUG worker 1 processing event 0xa23d0490
2024-02-14 19:46:37 DEBUG PROCESS_EVENT: DATA_AVAILABLE (tcp)
2024-02-14 19:46:37 DEBUG om_tcp_write
2024-02-14 19:46:37 DEBUG add socket [21]
2024-02-14 19:46:37 DEBUG socket already added to pollset with reqevents [21 != 21]
2024-02-14 19:46:37 DEBUG tcp get_next_logdata: got NULL (queuesize: 0)
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: MODULE_RESUME (eventlog)
2024-02-14 19:46:37 DEBUG event added to jobqueue
2024-02-14 19:46:37 DEBUG worker 0 got signal for new job
2024-02-14 19:46:37 DEBUG worker 0 processing event 0xa23d0580
2024-02-14 19:46:37 DEBUG worker 1 processing event 0xa23d0530
2024-02-14 19:46:37 DEBUG PROCESS_EVENT: POLL (tcp)
2024-02-14 19:46:37 DEBUG PROCESS_EVENT: MODULE_RESUME (eventlog)
2024-02-14 19:46:37 DEBUG nx_module_pollset_poll: tcp
2024-02-14 19:46:37 DEBUG RESUME: eventlog
2024-02-14 19:46:37 DEBUG module eventlog already running, skipping resume
2024-02-14 19:46:37 DEBUG worker 1 waiting for new event
2024-02-14 19:46:37 DEBUG [tcp] no poll events, pollset_poll timed out
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: POLL (tcp)
2024-02-14 19:46:37 DEBUG event added to jobqueue
2024-02-14 19:46:37 DEBUG worker 0 processing event 0xa23d03f0
2024-02-14 19:46:37 DEBUG PROCESS_EVENT: POLL (tcp)
2024-02-14 19:46:37 DEBUG nx_module_pollset_poll: tcp
2024-02-14 19:46:37 DEBUG worker 2 got signal for new job
2024-02-14 19:46:37 DEBUG worker 2 got no event to process
2024-02-14 19:46:37 DEBUG worker 2 waiting for new event
2024-02-14 19:46:37 DEBUG [tcp] no poll events, pollset_poll timed out
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: POLL (tcp)
2024-02-14 19:46:37 DEBUG event added to jobqueue
2024-02-14 19:46:37 DEBUG worker 1 got signal for new job
2024-02-14 19:46:37 DEBUG worker 1 processing event 0xa23d0490
2024-02-14 19:46:37 DEBUG worker 0 waiting for new event
2024-02-14 19:46:37 DEBUG PROCESS_EVENT: POLL (tcp)
2024-02-14 19:46:37 DEBUG nx_module_pollset_poll: tcp
2024-02-14 19:46:37 DEBUG [tcp] no poll events, pollset_poll timed out
2024-02-14 19:46:37 DEBUG nx_event_to_jobqueue: POLL (tcp)
2024-02-14 19:46:37 DEBUG event added to jobqueue
2024-02-14 19:46:37 DEBUG worker 2 got signal for new job
2024-02-14 19:46:37 DEBUG worker 2 processing event 0xa23d04e0
2024-02-14 19:46:37 DEBUG worker 1 waiting for new event
2024-02-14 19:46:37 DEBUG PROCESS_EVENT: POLL (tcp)
2024-02-14 19:46:37 DEBUG nx_module_pollset_poll: tcp
reesthil created
NXLOG on Windows - Logs sent with a very long delay
siem_20 created
Hi All,I am collecting and sending logs from a Windows Domain Controller (only security events). When I start the nxlog service, the logs are send in “real time”. However, Over time, a delay is generated, causing the accumulated delay to be hours after one day. What could happen to explain this behavior?Configurationdefine ROOT C:\Program Files\nxlog
define CERTDIR %ROOT%\cert
define CONFDIR %ROOT%\conf
define LOGDIR %ROOT%\data
define LOGFILE %LOGDIR%\nxlog.log
LogFile %LOGFILE%
Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
<Extension _json>
Module xm_json
</Extension>
<Input windows_security_eventlog>
Module im_msvistalog
<QueryXML>
<QueryList>
<Query Id="0">
<Select Path="Security">*</Select>
</Query>
</QueryList>
</QueryXML>
ReadFromLast True
SavePos True
</Input>
<Output out_chronicle_windevents>
Module om_tcp
Host 172.16.94.69
Port 41001
Exec $EventTime = integer($EventTime) / 1000;
Exec $EventReceivedTime = integer($EventReceivedTime) / 1000;
Exec to_json();
</Output>
<Route r2>
Path windows_security_eventlog => out_chronicle_windevents
</Route> Environment descriptionNXLog CE is running on Windows 2022 server Package version is 3.2.2329
siem_20 created
The MSI file seems to not be installing
CyberIke created
Whenever I try to run the .msi to install the Nxlog CE I get this error message Am doing something incorrectly or is the download file broken?
CyberIke created
SSL Certificate Error for im_ssl
staticfactory created
I'm trying to capture Secure Syslog from an external source. The sender is green lights, but the NXLog.log file is showing a lot of this:2024-01-22 15:58:08 INFO nxlog-ce-3.2.2329 started
2024-01-22 15:58:08 INFO connecting to 127.0.0.1:6515
2024-01-22 15:58:08 INFO successfully connected to 127.0.0.1:6515…
…
2024-01-22 16:14:32 WARNING SSL connection closed from (IP_REDACTED):53601
2024-01-22 16:14:32 ERROR SSL certificate verification failed: unable to get local issuer certificate (err: 20)
2024-01-22 16:14:32 WARNING SSL connection closed from (IP_REDACTED):46645
2024-01-22 16:14:32 ERROR SSL certificate verification failed: unable to get local issuer certificate (err: 20)
2024-01-22 16:14:32 WARNING SSL connection closed from (IP_REDACTED)47010
2024-01-22 16:14:32 ERROR SSL certificate verification failed: unable to get local issuer certificate (err: 20)
2024-01-22 16:14:32 WARNING SSL connection closed from (IP_REDACTED):46931
2024-01-22 16:14:32 ERROR SSL certificate verification failed: unable to get local issuer certificate (err: 20)
2024-01-22 16:14:32 WARNING SSL connection closed from (IP_REDACTED):46939
2024-01-22 16:14:32 INFO SSL connection accepted from (IP_REDACTED):43341and so on.I have tried just about every combination of certs/directives that I can find or think of, but I cannot get the connection to establish correctly. I validated the cert and chain using openssl and even tried using AllowExpired but that directive is not supported, apparently. The sending service is all green lights and happy. Any thoughts would be appreciated!Community version 3.2.2329 (Windows)conf:define ROOT C:\Program Files\nxlog
define CERTDIR C:\Program Files\nxlog\cert
Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.log
<Extension syslog>
Module xm_syslog
</Extension>
<Input ssl>
Module im_ssl
Host 192.168.1.11
Port 6514
CAFile %CERTDIR%\Valid_Public_CA.crt
CertFile %CERTDIR%\Valid_Public_cert.crt
CertKeyFile %CERTDIR%\Valid_Public_key_decrypted.key
AllowUntrusted TRUE
Exec parse_syslog();
</Input>
<Output ssl_output>
Module om_sslHost 127.0.0.1
Port 6515
CAFile %CERTDIR%\Self-Signed.pem
AllowUntrusted TRUE
</Output>
<Route 1>
Path ssl => ssl_output
</Route>
staticfactory created
Need Windows DNS NXLog query (Audit Logs)
krishna.pusuluri@gmail.com created
Hi Team,Can some one help me out here!I tried so many Windows DNS NXLog query (NXLog Community Edition) to capture the Audit Logs from Event Viewer, but no luck.Can you please provide the Windows DNS NXLog Query (NXLog Community Edition) to capture the Audit logs from Event Viewer. Thanks
krishna.pusuluri@gmail.com created
Forward MS SQL Database logs towards Syslog
manish.mohite created
Hello,I have Windows SQL server 2019 installed on Windows server 2019. i have installed the nxlog community edition on Server to forward the Database logs generating in following path: C:\Program Files\Microsoft SQL Server\MSSQL15.BAMSM\MSSQL\Log\ERRORLOGI have written following conf in nxlog but it i have not received any logs in Syslog Server. Kindly help me to resolve the issue if there is any changes to be done in the below mentioned configuration:<Extension _syslog> Module xm_syslog</Extension><Input in> Module im_file File “C:\\Program Files\\Microsoft SQL Server\\MSSQL15.BAMSM\\MSSQL\\Log\\ERRORLOG” SavePos TRUE Recursive TRUE</Input><Output out> Module om_udp Host 192.168.105.10 Port 514 Exec $Message = "TEST DB LOG " + $raw_event; Exec to_syslog_bsd();</Output><Route 1> Path in => out</Route>
manish.mohite created
NxLog rpm for SLES 12 - Community edition
Praveen created
Hello All,We are using NxLog community edition for deployments and realized that there's no rpm available for SLES 12 (its does have for SLES 15). How can I get rpm for sles 12.? I can see the rpm available under Enterprise downloads. How to contact support to get this.?Thank you
Praveen created