Unusual Mulitline Error message

Tags:

#1 smythmark

Seeing the following errors in the logs on a WIN 2008 R2 machine. Not 100% sure why but is seems to happen intermittently, I can't seem to corrolate it with log file rotations or anything like that. 

2017-03-31 12:46:52 ERROR if-else failed at line 10, character 39 in C:\Program Files (x86)\nxlog/conf/app_log/application_log_multiline_extensions.conf. statement execution has been aborted; binary operation failed at line 10, character 36 in C:\Program Files (x86)\nxlog/conf/app_log/application_log_multiline_extensions.conf. expression evaluation has been aborted; missing logdata, no field available in this context at line 10, character 19 in C:\Program Files (x86)\nxlog/conf/app_log/application_log_multiline_extensions.conf. operation possibly after drop()

hen it starts to appear it always happens at the exact same second of a given minute, but the number of minutes in between each erros seems somewhat random 

ie.

2017-03-31 10:37:42 ERROR if-else failed at line 16...

2017-03-31 10:40:42 ERROR if-else failed at line 16 ...

2017-03-31 10:41:42 ERROR if-else failed at line 16...

Config would be similar to below.

<Extension app_log_multiline>
    Module xm_multiline
    HeaderLine /.*\[\d\d \w\w\w \d\d\d\d/
    Exec if $raw_event =~ /^\s*$/ drop();
</Extension>

 

<Input in_app_log_files>
    Module im_file
    File '%APP_LOGS_DIR%\server_error.log'
    SavePos TRUE
    ReadFromLast TRUE 
    InputType app_log_multiline
    PollInterval 5
    DirCheckInterval 60
    CloseWhenIdle TRUE
    <Exec> 
        $Environment = "%ENVIRONMENT_TAG%"; 
        $Application = "%APP_TAG%"; 
        $Service = "%SERVICE_TAG%";
    </Exec>     
</Input>

 

#2 smythmark
#1 smythmark
Seeing the following errors in the logs on a WIN 2008 R2 machine. Not 100% sure why but is seems to happen intermittently, I can't seem to corrolate it with log file rotations or anything like that.  2017-03-31 12:46:52 ERROR if-else failed at line 10, character 39 in C:\Program Files (x86)\nxlog/conf/app_log/application_log_multiline_extensions.conf. statement execution has been aborted; binary operation failed at line 10, character 36 in C:\Program Files (x86)\nxlog/conf/app_log/application_log_multiline_extensions.conf. expression evaluation has been aborted; missing logdata, no field available in this context at line 10, character 19 in C:\Program Files (x86)\nxlog/conf/app_log/application_log_multiline_extensions.conf. operation possibly after drop() hen it starts to appear it always happens at the exact same second of a given minute, but the number of minutes in between each erros seems somewhat random  ie. 2017-03-31 10:37:42 ERROR if-else failed at line 16... 2017-03-31 10:40:42 ERROR if-else failed at line 16 ... 2017-03-31 10:41:42 ERROR if-else failed at line 16... Config would be similar to below. <Extension app_log_multiline>     Module xm_multiline     HeaderLine /.*\[\d\d \w\w\w \d\d\d\d/     Exec if $raw_event =~ /^\s*$/ drop(); </Extension>   <Input in_app_log_files>     Module im_file     File '%APP_LOGS_DIR%\server_error.log'     SavePos TRUE     ReadFromLast TRUE      InputType app_log_multiline     PollInterval 5     DirCheckInterval 60     CloseWhenIdle TRUE     <Exec>          $Environment = "%ENVIRONMENT_TAG%";          $Application = "%APP_TAG%";          $Service = "%SERVICE_TAG%";     </Exec>      </Input>  

Actually I am seeing some unusual "Inode changed" messages where the file clearly hasn't been rotated so might be related to that somehow, but in many cases it happens without any "inode change" messages at all