om_file Module problem

Tags:

#1 GavinChen

Sorry,my english is not good.

I occur a problem with om_file module. my config as following:


#define Log receive from Network
<Input LogNetIn>
    Module      im_tcp
    host        0.0.0.0
    port        1514
    <Exec>
        if $raw_event =~ /^"([^"]+)"/ {
            $ModuleName=$1 ;
        } else if $raw_event =~ /ModuleName=([^\d]+)/{
            $ModuleName=$1 ;
        } else {
            file_write('%ROOT%\data\debug.txt',$raw_event +"\r\n");
        }

        if ($ModuleName=="HB") {
            HB_IL_CSV->parse_csv();
            HB_CSV->to_csv();
            $StorePathFileName='%ROOT%\data\heartbeat.log';
        }else if ($ModuleName=="IL") {
            HB_IL_CSV->parse_csv();
            IL_CSV->to_csv();
            $StorePathFileName='%ROOT%\data\nxlog_agents.log';
        }else if ($ModuleName=="WinEventIn") {
            WinEventNetIn_CSV->parse_csv();
            WinEventFileOut_CSV->to_csv();
            $StorePathFileName='%ServersLogStorePath%\'+$Department+'\'+$Section+'\'+ $SourceHostName + '\WinEventLog\'+ $Channel +'\' + strftime($EventTime,"%Y%m%d")+'_'+ $SourceHostName + '_' + $Channel+ '.csv';
        }else if ($ModuleName=="WebLog" or $ModuleName=="TransLog" or $ModuleName=="OthersLog") {
            LogKvp->parse_kvp();
            $raw_event=$Message;
            $StorePathFileName='%ServersLogStorePath%\'+$Department+'\'+$Section+'\'+ $Hostname + '\' + $ModuleName +'\' + $ParentDir + '\' + $FileName;
        }else {
            file_write('%ROOT%\data\debugModuleName.txt',$ModuleName +"\r\n");
            $StorePathFileName='%ROOT%\data\UnknownLog.log';
        }
        
        create_stat("stat", "RATE", 1); add_stat("stat", 1);
    </Exec>
    <Schedule>
        Every   1 sec
        Exec    log_info("EPS: " + get_stat("stat"));
    </Schedule>
</Input>

#define Log Network Receive Buffer
<Processor LogNetInBuffer>
    Module      pm_buffer
    # 4096MB buffer
    MaxSize    4194304
    Type    Mem
    # warn at 10MB
    WarnLimit    10240
    #<Schedule>
    #    Every   10 sec
    #    Exec    log_info("BufferSize: " + buffer_size() + ",BufferCount: " +  buffer_count());
    #</Schedule>
</Processor>

#define Log Output File
<Output LogStoreFile>
     Module      om_file
     CreateDir TRUE
     File        $StorePathFileName
</Output>

<Route LogRoute>
    Path   LogNetIn => LogNetInBuffer => LogStoreFile
</Route>


When I  use ultraedit text editor to open the file "20160126_VMNXLOGCLT_Security.csv". I found nxlog.log of ServerSide has as following error.


2016-01-27 17:23:29 ERROR failed to open \\apstor1\Eventlog\Servers\WinEventLog\Security\20160126_VMNXLOGCLT_Security.csv; The process cannot access the file because it is being used by another process.  
2016-01-27 17:23:30 INFO EPS: 129
2016-01-27 17:23:31 INFO EPS: 124
2016-01-27 17:23:31 INFO EPS: 124
2016-01-27 17:23:33 INFO EPS: 129
2016-01-27 17:23:33 INFO EPS: 129
2016-01-27 17:23:34 ERROR failed to open \\apstor1\Eventlog\Servers\WinEventLog\Security\20160126_VMNXLOGCLT_Security.csv; The process cannot access the file because it is being used by another process.  
2016-01-27 17:23:35 ERROR last message repeated 2 times
2016-01-27 17:23:35 INFO EPS: 126


The Server Side nxlog process will not output any file and it continuous consume memory, I must restart nxlog services that recover work.

So, how do I solve this problem ?

Regards

 

#2 adm Nxlog ✓
#1 GavinChen
Sorry,my english is not good. I occur a problem with om_file module. my config as following: #define Log receive from Network <Input LogNetIn>     Module      im_tcp     host        0.0.0.0     port        1514     <Exec>         if $raw_event =~ /^"([^"]+)"/ {             $ModuleName=$1 ;         } else if $raw_event =~ /ModuleName=([^\d]+)/{             $ModuleName=$1 ;         } else {             file_write('%ROOT%\data\debug.txt',$raw_event +"\r\n");         }         if ($ModuleName=="HB") {             HB_IL_CSV->parse_csv();             HB_CSV->to_csv();             $StorePathFileName='%ROOT%\data\heartbeat.log';         }else if ($ModuleName=="IL") {             HB_IL_CSV->parse_csv();             IL_CSV->to_csv();             $StorePathFileName='%ROOT%\data\nxlog_agents.log';         }else if ($ModuleName=="WinEventIn") {             WinEventNetIn_CSV->parse_csv();             WinEventFileOut_CSV->to_csv();             $StorePathFileName='%ServersLogStorePath%\'+$Department+'\'+$Section+'\'+ $SourceHostName + '\WinEventLog\'+ $Channel +'\' + strftime($EventTime,"%Y%m%d")+'_'+ $SourceHostName + '_' + $Channel+ '.csv';         }else if ($ModuleName=="WebLog" or $ModuleName=="TransLog" or $ModuleName=="OthersLog") {             LogKvp->parse_kvp();             $raw_event=$Message;             $StorePathFileName='%ServersLogStorePath%\'+$Department+'\'+$Section+'\'+ $Hostname + '\' + $ModuleName +'\' + $ParentDir + '\' + $FileName;         }else {             file_write('%ROOT%\data\debugModuleName.txt',$ModuleName +"\r\n");             $StorePathFileName='%ROOT%\data\UnknownLog.log';         }                  create_stat("stat", "RATE", 1); add_stat("stat", 1);     </Exec>     <Schedule>         Every   1 sec         Exec    log_info("EPS: " + get_stat("stat"));     </Schedule> </Input> #define Log Network Receive Buffer <Processor LogNetInBuffer>     Module      pm_buffer     # 4096MB buffer     MaxSize    4194304     Type    Mem     # warn at 10MB     WarnLimit    10240     #<Schedule>     #    Every   10 sec     #    Exec    log_info("BufferSize: " + buffer_size() + ",BufferCount: " +  buffer_count());     #</Schedule> </Processor> #define Log Output File <Output LogStoreFile>      Module      om_file      CreateDir TRUE      File        $StorePathFileName </Output> <Route LogRoute>     Path   LogNetIn => LogNetInBuffer => LogStoreFile </Route> When I  use ultraedit text editor to open the file "20160126_VMNXLOGCLT_Security.csv". I found nxlog.log of ServerSide has as following error. 2016-01-27 17:23:29 ERROR failed to open \\apstor1\Eventlog\Servers\WinEventLog\Security\20160126_VMNXLOGCLT_Security.csv; The process cannot access the file because it is being used by another process.   2016-01-27 17:23:30 INFO EPS: 129 2016-01-27 17:23:31 INFO EPS: 124 2016-01-27 17:23:31 INFO EPS: 124 2016-01-27 17:23:33 INFO EPS: 129 2016-01-27 17:23:33 INFO EPS: 129 2016-01-27 17:23:34 ERROR failed to open \\apstor1\Eventlog\Servers\WinEventLog\Security\20160126_VMNXLOGCLT_Security.csv; The process cannot access the file because it is being used by another process.   2016-01-27 17:23:35 ERROR last message repeated 2 times 2016-01-27 17:23:35 INFO EPS: 126 The Server Side nxlog process will not output any file and it continuous consume memory, I must restart nxlog services that recover work. So, how do I solve this problem ? Regards  

If you need to open the file you should use a text editor that does not lock the file. Most editors are known to do this (e.g. wordpad) but some don't (e.g. notepad). Alternatively you can create a copy of the file and open that.