route to local file.
Hi there, I have the following log server setup which recevice log from various servers and route to another server as well as written to a local file.
<router>
path from_other_servers => output_another_server, local_zip_encrypted_file
<\route>
it seems for smaller log size, I have to restarts the nxlog before the file can be written locally. (the file is empty when I tried to decrypt and uncompress the file)
(1) is it possible to force flush into local file in regular basis?
(2) though I don't see the log written to local file, can I check if the log is forwarded to another server in this case?
Thanks in advance
Best regards,
Loh
As you're the user of EE - you'd better direct this question to the support line. It would be just faster :)
Q1. Could you share more details about event flow? I just did a local test - it perfectly drops the data to the file according to batching parameters (see the note near the top https://docs.nxlog.co/refman/current/xm/zlib.html ). If you are worried - you can:
1. Decrease CompBufSize, but you cannot go lower than 8k of raw data per batch. That's why I ask about the event flow.
2. Use om_file Sync TRUE. Will increase the CPU load.
3. Rotate the files once in some time. This will force om_file to finish zlib batch, flush the buffers and close the file without restarting the agent.
Test config:
<Extension zlib>
Module xm_zlib
</Extension>
<input in1>
Module im_testgen
</input>
<output om1>
Module om_file
File "C:\Program Files\nxlog\data\zlib-test.zip"
OutputType zlib.compress
Sync TRUE
<Schedule>
Every 30 sec
Exec rotate_to("zlib-test-prev.zip");
</Schedule
</output>
<Route r1>
Path in1=>om1
</Route>
Q2. You can use either COUNT or EPS statcounter and write it to the log. I'd advise you to use the second one as it will also help to diagnose the network condition changes. Or, you can use xm_admin in listening mode and pull almost the same data with ModuleInfo request from curl-based script. Or just use Platform - the same is visible in it's UI.
