nxlog v2.9.1357 windows always says keyword else invalid. | View post

yoke88 9 years ago

2015-04-29 20:32:46 INFO nxlog-ce-2.9.1347 started
2015-04-29 21:08:14 WARNING stopping nxlog service
2015-04-29 21:08:14 WARNING nxlog-ce received a termination request signal, exiting...
2015-04-29 21:08:15 ERROR invalid keyword: else at C:\Program Files (x86)\nxlog\conf\nxlog.conf:60
2015-04-29 21:08:15 ERROR module 'in' has configuration errors, not adding to route '2' at C:\Program Files (x86)\nxlog\conf\nxlog.conf:89
2015-04-29 21:08:15 WARNING not starting unused module in
2015-04-29 21:08:15 INFO connecting to 172.18.1.11:5142
2015-04-29 21:08:15 INFO nxlog-ce-2.9.1347 started
2015-04-29 21:08:15 ERROR if-else failed at line 77, character 234 in C:\Program Files (x86)\nxlog\conf\nxlog.conf. statement execution has been aborted; procedure 'parse_csv' failed at line 77, character 80 in C:\Program Files (x86)\nxlog\conf\nxlog.conf. statement execution has been aborted; Not enough fields in CSV input, expected 17, got 1 in input ' #Software: Microsoft Exchange Server'

Here is my conf file

#define ROOT C:\Program Files\nxlog
define ROOT C:\Program Files (x86)\nxlog
define IGNORE_COMMENT if $raw_event =~ /^#/ drop();
define BASEDIR C:\Program Files\Microsoft\Exchange Server\V14\TransportRoles\Logs\MessageTracking
define AgentLog_dir C:\Program Files\Microsoft\Exchange Server\V14\TransportRoles\Logs\AgentLog

Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.log
#LogLevel DEBUG
<Extension _syslog>
Module xm_syslog
</Extension>

<Extension _json>
Module xm_json
</Extension>

<Extension ExAgentLog>
   Module       xm_csv
   Fields       $Timestamp,$SessionId,$LocalEndpoint,$RemoteEndpoint,$EnteredOrgFromIP,$MessageId,$P1FromAddress,$P2FromAddresses,$Recipient,$NumRecipients,$Agent,$Event,$Action,$SmtpResponse,$Reason,$ReasonData,$Diagnostics
   FieldTypes   String,String,String,String,String,String,String,String,String,Integer,String,String,String,String,String,String,String
   Delimiter   ,
</Extension>

<Extension ExMSGTRK>
   Module       xm_csv
   Fields       $date-time,$client-ip,$client-hostname,$server-ip,$server-hostname,$source-context,$connector-id,$source,$event-id,$internal-message-id,$message-id,$recipient-address,$recipient-status,$total-bytes,$recipient-count,$related-recipient-address,$reference,$message-subject,$sender-address,$return-path,$message-info,$directionality,$tenant-id,$original-client-ip,$original-server-ip,$custom-data
   FieldTypes   String,String,String,String,String,String,String,String,String,String,String,String,String,Integer,Integer,String,String,String,String,String,String,String,String,String,String,String
   Delimiter   ,
</Extension>

<Extension charconv>
Module xm_charconv
AutodetectCharsets utf-8,UNICODE,utf-16, utf-32, iso8859-2
</Extension>

<Input in>
Module im_file
   File       '%BASEDIR%\MSGTRK????????*-*.LOG'
   ReadFromLast FALSE
   Exec if $raw_event =~ /^#/ drop();\
               else \
               {   \
                   ExMSGTRK->parse_csv();\
                   delete($SourceModuleName);\
                   delete($SourceModuleType);\
                   delete($EventReceivedTime);\
                   $SourceName="Message Tracking Log";   \
                   to_json();\
               }
</Input>

<Input in2>
   Module       im_file
   ReadFromLast FALSE
   File       '%AgentLog_dir%\AgentLog*.LOG'

   EXEC        if $raw_event =~ /^#/ drop();\
               else \
               {\
                   ExAgentLog->parse_csv();   \
                   delete($SourceModuleName);   \
                   delete($SourceModuleType);   \
                   delete($EventReceivedTime); \
                   $SourceName="Agent Log";   \
                   to_json();       \
               }

</Input>

<Output out2>
Module om_tcp
Host 172.18.1.11
Port 5142
</Output>