om_file Module problem
Sorry,my english is not good.
I occur a problem with om_file module. my config as following:
#define Log receive from Network
<Input LogNetIn>
Module im_tcp
host 0.0.0.0
port 1514
<Exec>
if $raw_event =~ /^"([^"]+)"/ {
$ModuleName=$1 ;
} else if $raw_event =~ /ModuleName=([^\d]+)/{
$ModuleName=$1 ;
} else {
file_write('%ROOT%\data\debug.txt',$raw_event +"\r\n");
}
if ($ModuleName=="HB") {
HB_IL_CSV->parse_csv();
HB_CSV->to_csv();
$StorePathFileName='%ROOT%\data\heartbeat.log';
}else if ($ModuleName=="IL") {
HB_IL_CSV->parse_csv();
IL_CSV->to_csv();
$StorePathFileName='%ROOT%\data\nxlog_agents.log';
}else if ($ModuleName=="WinEventIn") {
WinEventNetIn_CSV->parse_csv();
WinEventFileOut_CSV->to_csv();
$StorePathFileName='%ServersLogStorePath%\'+$Department+'\'+$Section+'\'+ $SourceHostName + '\WinEventLog\'+ $Channel +'\' + strftime($EventTime,"%Y%m%d")+'_'+ $SourceHostName + '_' + $Channel+ '.csv';
}else if ($ModuleName=="WebLog" or $ModuleName=="TransLog" or $ModuleName=="OthersLog") {
LogKvp->parse_kvp();
$raw_event=$Message;
$StorePathFileName='%ServersLogStorePath%\'+$Department+'\'+$Section+'\'+ $Hostname + '\' + $ModuleName +'\' + $ParentDir + '\' + $FileName;
}else {
file_write('%ROOT%\data\debugModuleName.txt',$ModuleName +"\r\n");
$StorePathFileName='%ROOT%\data\UnknownLog.log';
}
create_stat("stat", "RATE", 1); add_stat("stat", 1);
</Exec>
<Schedule>
Every 1 sec
Exec log_info("EPS: " + get_stat("stat"));
</Schedule>
</Input>
#define Log Network Receive Buffer
<Processor LogNetInBuffer>
Module pm_buffer
# 4096MB buffer
MaxSize 4194304
Type Mem
# warn at 10MB
WarnLimit 10240
#<Schedule>
# Every 10 sec
# Exec log_info("BufferSize: " + buffer_size() + ",BufferCount: " + buffer_count());
#</Schedule>
</Processor>
#define Log Output File
<Output LogStoreFile>
Module om_file
CreateDir TRUE
File $StorePathFileName
</Output>
<Route LogRoute>
Path LogNetIn => LogNetInBuffer => LogStoreFile
</Route>
When I use ultraedit text editor to open the file "20160126_VMNXLOGCLT_Security.csv". I found nxlog.log of ServerSide has as following error.
2016-01-27 17:23:29 ERROR failed to open \\apstor1\Eventlog\Servers\WinEventLog\Security\20160126_VMNXLOGCLT_Security.csv; The process cannot access the file because it is being used by another process.
2016-01-27 17:23:30 INFO EPS: 129
2016-01-27 17:23:31 INFO EPS: 124
2016-01-27 17:23:31 INFO EPS: 124
2016-01-27 17:23:33 INFO EPS: 129
2016-01-27 17:23:33 INFO EPS: 129
2016-01-27 17:23:34 ERROR failed to open \\apstor1\Eventlog\Servers\WinEventLog\Security\20160126_VMNXLOGCLT_Security.csv; The process cannot access the file because it is being used by another process.
2016-01-27 17:23:35 ERROR last message repeated 2 times
2016-01-27 17:23:35 INFO EPS: 126
The Server Side nxlog process will not output any file and it continuous consume memory, I must restart nxlog services that recover work.
So, how do I solve this problem ?
Regards
If you need to open the file you should use a text editor that does not lock the file. Most editors are known to do this (e.g. wordpad) but some don't (e.g. notepad). Alternatively you can create a copy of the file and open that.