Unusual Mulitline Error message

View thread

smythmark

Seeing the following errors in the logs on a WIN 2008 R2 machine. Not 100% sure why but is seems to happen intermittently, I can't seem to corrolate it with log file rotations or anything like that. 

2017-03-31 12:46:52 ERROR if-else failed at line 10, character 39 in C:\Program Files (x86)\nxlog/conf/app_log/application_log_multiline_extensions.conf. statement execution has been aborted; binary operation failed at line 10, character 36 in C:\Program Files (x86)\nxlog/conf/app_log/application_log_multiline_extensions.conf. expression evaluation has been aborted; missing logdata, no field available in this context at line 10, character 19 in C:\Program Files (x86)\nxlog/conf/app_log/application_log_multiline_extensions.conf. operation possibly after drop()

hen it starts to appear it always happens at the exact same second of a given minute, but the number of minutes in between each erros seems somewhat random 

ie.

2017-03-31 10:37:42 ERROR if-else failed at line 16...

2017-03-31 10:40:42 ERROR if-else failed at line 16 ...

2017-03-31 10:41:42 ERROR if-else failed at line 16...

Config would be similar to below.

<Extension app_log_multiline>
    Module xm_multiline
    HeaderLine /.*\[\d\d \w\w\w \d\d\d\d/
    Exec if $raw_event =~ /^\s*$/ drop();
</Extension>

 

<Input in_app_log_files>
    Module im_file
    File '%APP_LOGS_DIR%\server_error.log'
    SavePos TRUE
    ReadFromLast TRUE 
    InputType app_log_multiline
    PollInterval 5
    DirCheckInterval 60
    CloseWhenIdle TRUE
    <Exec> 
        $Environment = "%ENVIRONMENT_TAG%"; 
        $Application = "%APP_TAG%"; 
        $Service = "%SERVICE_TAG%";
    </Exec>     
</Input>