om_file Module problem

View thread

GavinChen

Sorry,my english is not good.

I occur a problem with om_file module. my config as following:


#define Log receive from Network
<Input LogNetIn>
    Module      im_tcp
    host        0.0.0.0
    port        1514
    <Exec>
        if $raw_event =~ /^"([^"]+)"/ {
            $ModuleName=$1 ;
        } else if $raw_event =~ /ModuleName=([^\d]+)/{
            $ModuleName=$1 ;
        } else {
            file_write('%ROOT%\data\debug.txt',$raw_event +"\r\n");
        }

        if ($ModuleName=="HB") {
            HB_IL_CSV->parse_csv();
            HB_CSV->to_csv();
            $StorePathFileName='%ROOT%\data\heartbeat.log';
        }else if ($ModuleName=="IL") {
            HB_IL_CSV->parse_csv();
            IL_CSV->to_csv();
            $StorePathFileName='%ROOT%\data\nxlog_agents.log';
        }else if ($ModuleName=="WinEventIn") {
            WinEventNetIn_CSV->parse_csv();
            WinEventFileOut_CSV->to_csv();
            $StorePathFileName='%ServersLogStorePath%\'+$Department+'\'+$Section+'\'+ $SourceHostName + '\WinEventLog\'+ $Channel +'\' + strftime($EventTime,"%Y%m%d")+'_'+ $SourceHostName + '_' + $Channel+ '.csv';
        }else if ($ModuleName=="WebLog" or $ModuleName=="TransLog" or $ModuleName=="OthersLog") {
            LogKvp->parse_kvp();
            $raw_event=$Message;
            $StorePathFileName='%ServersLogStorePath%\'+$Department+'\'+$Section+'\'+ $Hostname + '\' + $ModuleName +'\' + $ParentDir + '\' + $FileName;
        }else {
            file_write('%ROOT%\data\debugModuleName.txt',$ModuleName +"\r\n");
            $StorePathFileName='%ROOT%\data\UnknownLog.log';
        }
        
        create_stat("stat", "RATE", 1); add_stat("stat", 1);
    </Exec>
    <Schedule>
        Every   1 sec
        Exec    log_info("EPS: " + get_stat("stat"));
    </Schedule>
</Input>

#define Log Network Receive Buffer
<Processor LogNetInBuffer>
    Module      pm_buffer
    # 4096MB buffer
    MaxSize    4194304
    Type    Mem
    # warn at 10MB
    WarnLimit    10240
    #<Schedule>
    #    Every   10 sec
    #    Exec    log_info("BufferSize: " + buffer_size() + ",BufferCount: " +  buffer_count());
    #</Schedule>
</Processor>

#define Log Output File
<Output LogStoreFile>
     Module      om_file
     CreateDir TRUE
     File        $StorePathFileName
</Output>

<Route LogRoute>
    Path   LogNetIn => LogNetInBuffer => LogStoreFile
</Route>


When I  use ultraedit text editor to open the file "20160126_VMNXLOGCLT_Security.csv". I found nxlog.log of ServerSide has as following error.


2016-01-27 17:23:29 ERROR failed to open \\apstor1\Eventlog\Servers\WinEventLog\Security\20160126_VMNXLOGCLT_Security.csv; The process cannot access the file because it is being used by another process.  
2016-01-27 17:23:30 INFO EPS: 129
2016-01-27 17:23:31 INFO EPS: 124
2016-01-27 17:23:31 INFO EPS: 124
2016-01-27 17:23:33 INFO EPS: 129
2016-01-27 17:23:33 INFO EPS: 129
2016-01-27 17:23:34 ERROR failed to open \\apstor1\Eventlog\Servers\WinEventLog\Security\20160126_VMNXLOGCLT_Security.csv; The process cannot access the file because it is being used by another process.  
2016-01-27 17:23:35 ERROR last message repeated 2 times
2016-01-27 17:23:35 INFO EPS: 126


The Server Side nxlog process will not output any file and it continuous consume memory, I must restart nxlog services that recover work.

So, how do I solve this problem ?

Regards