nxlog v2.9.1357 windows always says keyword else invalid.
2015-04-29 20:32:46 INFO nxlog-ce-2.9.1347 started
2015-04-29 21:08:14 WARNING stopping nxlog service
2015-04-29 21:08:14 WARNING nxlog-ce received a termination request signal, exiting...
2015-04-29 21:08:15 ERROR invalid keyword: else at C:\Program Files (x86)\nxlog\conf\nxlog.conf:60
2015-04-29 21:08:15 ERROR module 'in' has configuration errors, not adding to route '2' at C:\Program Files (x86)\nxlog\conf\nxlog.conf:89
2015-04-29 21:08:15 WARNING not starting unused module in
2015-04-29 21:08:15 INFO connecting to 172.18.1.11:5142
2015-04-29 21:08:15 INFO nxlog-ce-2.9.1347 started
2015-04-29 21:08:15 ERROR if-else failed at line 77, character 234 in C:\Program Files (x86)\nxlog\conf\nxlog.conf. statement execution has been aborted; procedure 'parse_csv' failed at line 77, character 80 in C:\Program Files (x86)\nxlog\conf\nxlog.conf. statement execution has been aborted; Not enough fields in CSV input, expected 17, got 1 in input ' #Software: Microsoft Exchange Server'
#define ROOT C:\Program Files\nxlog
define ROOT C:\Program Files (x86)\nxlog
define IGNORE_COMMENT if $raw_event =~ /^#/ drop();
define BASEDIR C:\Program Files\Microsoft\Exchange Server\V14\TransportRoles\Logs\MessageTracking
define AgentLog_dir C:\Program Files\Microsoft\Exchange Server\V14\TransportRoles\Logs\AgentLog
Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.log
#LogLevel DEBUG
<Extension _syslog>
Module xm_syslog
</Extension>
<Extension _json>
Module xm_json
</Extension>
<Extension ExAgentLog>
Module xm_csv
Fields $Timestamp,$SessionId,$LocalEndpoint,$RemoteEndpoint,$EnteredOrgFromIP,$MessageId,$P1FromAddress,$P2FromAddresses,$Recipient,$NumRecipients,$Agent,$Event,$Action,$SmtpResponse,$Reason,$ReasonData,$Diagnostics
FieldTypes String,String,String,String,String,String,String,String,String,Integer,String,String,String,String,String,String,String
Delimiter ,
</Extension>
<Extension ExMSGTRK>
Module xm_csv
Fields $date-time,$client-ip,$client-hostname,$server-ip,$server-hostname,$source-context,$connector-id,$source,$event-id,$internal-message-id,$message-id,$recipient-address,$recipient-status,$total-bytes,$recipient-count,$related-recipient-address,$reference,$message-subject,$sender-address,$return-path,$message-info,$directionality,$tenant-id,$original-client-ip,$original-server-ip,$custom-data
FieldTypes String,String,String,String,String,String,String,String,String,String,String,String,String,Integer,Integer,String,String,String,String,String,String,String,String,String,String,String
Delimiter ,
</Extension>
<Extension charconv>
Module xm_charconv
AutodetectCharsets utf-8,UNICODE,utf-16, utf-32, iso8859-2
</Extension>
<Input in>
Module im_file
File '%BASEDIR%\MSGTRK????????*-*.LOG'
ReadFromLast FALSE
Exec if $raw_event =~ /^#/ drop();\
else \
{ \
ExMSGTRK->parse_csv();\
delete($SourceModuleName);\
delete($SourceModuleType);\
delete($EventReceivedTime);\
$SourceName="Message Tracking Log"; \
to_json();\
}
</Input>
<Input in2>
Module im_file
ReadFromLast FALSE
File '%AgentLog_dir%\AgentLog*.LOG'
EXEC if $raw_event =~ /^#/ drop();\
else \
{\
ExAgentLog->parse_csv(); \
delete($SourceModuleName); \
delete($SourceModuleType); \
delete($EventReceivedTime); \
$SourceName="Agent Log"; \
to_json(); \
}
</Input>
<Output out2>
Module om_tcp
Host 172.18.1.11
Port 5142
</Output>
<Route 2>
Path in,in2 => out2
</Route>
You should remove the spaces after the backslash '\' here:
Exec if $raw_event =~ /^#/ drop();\
