The NXLOG Process 100% CPU Load after Server restart.


#1 Wolfgang E (Last updated )

Hi NXLOG Community,

the NXLOG Process 100% CPU Load after Server restart on Windows Systems.
The Problemcause is simple but i dont understand why.

A Handfull of Servers whit much logfiles (nxlogconfiguration use Wildcard for logfolder(s)).
The Logfiles are written in the Cachefile and looks okay. 
But it feels like digs through all log files.

Small footage of a Configuration:

<Input catalina>
	Module im_file
	File 'C:\Tomcat\logs\\catalina*.log'
	Recursive    True
	PollInterval 30
	SavePos      True
	CloseWhenIdle       True
&lt;Exec&gt;
	#parse date
	if $raw_event =~ /(\d\d\-\S\S\S-\d\d\d\d \d\d:\d\d:\d\d)/  $EventTime = strptime($1, '%d-%b-%Y%t%H:%M:%S');
    # Now set the severity to something custom. This defaults to 'INFO' if unset.
    if $raw_event =~ /\sSEVERE\s/ $Severity = 'CRITICAL';
	else if $raw_event =~ /\sERROR\s/ $Severity = 'ERROR';
	else if $raw_event =~ /\sWARN\s/ $Severity = 'WARNING';
    else $Severity = 'INFO';

    # The facility can be also set, otherwise the default value is 'USER'.
    $SyslogFacility = 'AUDIT';
&lt;/Exec&gt;

</Input>


We use the Last CE Version.: nxlog-ce-3.2.2329

Thanks, regards Wolfgang 

#2 Emeka Nwankwo Nxlog ✓
#1 Wolfgang E
Hi NXLOG Community,the NXLOG Process 100% CPU Load after Server restart on Windows Systems.The Problemcause is simple but i dont understand why.A Handfull of Servers whit much logfiles (nxlogconfiguration use Wildcard for logfolder(s)).The Logfiles are written in the Cachefile and looks okay. But it feels like digs through all log files.Small footage of a Configuration:<Input catalina> Module im_file File 'C:\Tomcat\logs\\catalina*.log' Recursive True PollInterval 30 SavePos True CloseWhenIdle True &lt;Exec&gt; #parse date if $raw_event =~ /(\d\d\-\S\S\S-\d\d\d\d \d\d:\d\d:\d\d)/ $EventTime = strptime($1, '%d-%b-%Y%t%H:%M:%S'); # Now set the severity to something custom. This defaults to 'INFO' if unset. if $raw_event =~ /\sSEVERE\s/ $Severity = 'CRITICAL'; else if $raw_event =~ /\sERROR\s/ $Severity = 'ERROR'; else if $raw_event =~ /\sWARN\s/ $Severity = 'WARNING'; else $Severity = 'INFO'; # The facility can be also set, otherwise the default value is 'USER'. $SyslogFacility = 'AUDIT'; &lt;/Exec&gt; </Input>We use the Last CE Version.: nxlog-ce-3.2.2329Thanks, regards Wolfgang 

Hi @Wolfgang,

The number of actively read files can result in increase in buffer and resources.

Could you try adding the ActiveFiles directive to the im_file config to limit the active read files to maybe 5 or a number you can test with?

<Input catalina>
	Module im_file
	File 'C:\Tomcat\logs\\catalina*.log'
	Recursive    True
	PollInterval 30
	SavePos      True
	CloseWhenIdle       True
	ActiveFiles   5
	....

 

Emeka.