WARNING nxlog-ce received a termination request signal, exiting...


#1 vic chen (Last updated )

Why do I always receive the message "WARNING nxlog-ce received a termination request signal, exiting..." and I don't receive any message using GELF UDP in Graylog input, unless I use Raw/Plaintext UDP?

 

Panic Soft
#NoFreeOnExit TRUE

define ROOT C:\Program Files\nxlog define CERTDIR %ROOT%\cert define CONFDIR %ROOT%\conf\nxlog.d define LOGDIR %ROOT%\data

include %CONFDIR%\*.conf define LOGFILE %LOGDIR%\nxlog.log LogFile %LOGFILE%

Moduledir %ROOT%\modules CacheDir %ROOT%\data Pidfile %ROOT%\data\nxlog.pid SpoolDir %ROOT%\data

define IISLOG "C:\inetpub\logs\LogFiles\W3SVC2\u_ex*.log"

#######################################################################

EXTENTIONS

#######################################################################

<Extension _gelf> Module xm_gelf </Extension> <Extension _json> Module xm_json </Extension> <Extension fileop> Module xm_fileop </Extension> #######################################################################

IIS NXLOG

#######################################################################

<Extension w3c> Module xm_csv Fields $date, $time, $s_ip FieldTypes string, string, string Delimiter ' ' QuoteChar '"' EscapeControl FALSE UndefValue - </Extension>

<Input iis> Module im_file File "C:\inetpub\logs\LogFiles\W3SVC2\u_ex*.log" SavePos TRUE

Exec if $raw_event =~/^#/ drop();\
   else\
   {\
    w3c-&gt;parse_csv();\
    $EventTime = parsedate($date + " " + $time);\
$EventTime = parsedate($date + " " + $time + "Z");\
    $SourceName = "IIS";\
$raw_event = to_json();\
   }

</Input>

<Output graylog> Module om_udp Host 192.168.3.250 Port 1322 OutputType GELF

Exec        $Hostname = hostname_fqdn();
Exec        $raw_event =$Hostname + ' IIS-NXLOG ' + $raw_event;
#Use the following line for debugging (uncomment the fileop extension above as well)
# exec file_write("C:\\Program Files\\nxlog\\data\\nxlog_output.log", $raw_event);

</Output>

<Route iis-to-graylog> Path iis => graylog </Route>

#2 NenadM

Hello,

The message you mentioned - “WARNING nxlog-ce received a termination request signal, exiting” is a typical log record that you can see every time the nxlog service stops. It is recorded in the C:\Program Files\nxlog\data\nxlog.log  file. This is the internal log you'll get no matter if you use the file_write procedure.Those internal NXLog's logs are not routed to any output 
Please elaborate the second part:
“and I don't receive any message using GELF UDP in Graylog input, unless I use Raw/Plaintext UDP?”