Ask questions. Get answers. Find technical product solutions from passionate experts in the NXLog community.

Windows PowerShell Silent Install of NxLog
Hi, I was wondering if anyone could help me please. I want to use PowerShell to do a silent install of NxLog, I have tried different ways of using MSIEXEC in powershell and command line but I just can't seem to get it working. Any advice would be great.   Thanks.

IanMcShane created
Replies: 1
View post »
last updated
MSWinEventLog
Sorry I am new to this. Where in the config file do you set it to pull from MSWinEventLog?   Thanks in advance!

cidvicious created
Replies: 2
View post »
last updated
Won't install on Windows 10 / service doesn't get installed?
We've had some clients where we install & deploy the MSI via group policy -- using the latest version 2.9.1347. On Windows 10 -- it looks like the install succeeds (all the nx log files exist in Program Files (x86), etc.) -- but the service never gets installed. We don't see the nx log service anywhere in services.msc -- and don't see any logs saying that its install failed. We've now seen this on multiple Windows 10 machines. Has anyone else -- and is there a workaround?

wingows10guy created
NXLog CE: function for logs transfer
Hello I write input module for nxlog. I have wrote function to read data but I don't know how to tranfer data further. Which function should I call? nx_logdata_set_string?

Tuxizm created
Replies: 1
View post »
last updated
im_odbc ConnectionString question
Hi, my ODBC import won't work, checked everything but always this error occurs: ERROR im_odbc couldn't connect to the database, IM014:1:0:[Microsoft][ODBC Driver Manager] The specified DSN contains an architecture mismatch between the Driver and Application Config: <Input ODBC> Module im_odbc ConnectionString DSN=S_ODBC;database=SophosSecurity; SavePos TRUE PollInterval 5 IdIsTimestamp FALSE </Input> best regards

honigmann created
Replies: 1
View post »
last updated
Possible to read log file with new logs added to top of file?
I'm using NXLog to read log files and send to to Logstash. Normally this works fine, but I'm now trying to send logs from a file, where the new events gets added at the top of the file, not the bottom. Now it's not sending anything. This is from my NXLog config. <Input file> Module im_file File "C:\\TEMP\\export.txt" InputType LineBased Exec $Message = $raw_event; SavePos TRUE ReadFromLast TRUE Exec if $raw_event =~ /^#/ drop(); Is it possible to read from bottom to top?

RVZ created
Replies: 1
View post »
last updated
Performance statistics/measurements of nxLog on Windows
Are there any numbers about how nxLog performs when it is processing a high rate of messages being placed into a log file? Right now we have a couple of incidents which resulted in a few thousand messages being logged per second. I assume this is more than nxLog can handle but am wondering about any performance testing that has been run

J_Grieb created
Replies: 1
View post »
last updated
where to find im_dbi?
Hi, I need to use im_dbi import module of nxlog. This module isn't part of actual setup, so where can I get it? regards Christian

honigmann created
Replies: 2
View post »
last updated
nxlog.rpm installation error
Hi all, after installd nxlog-ce-2.9.1347-1_rhe6.x86_64.rpm on Red Hat I tried to start the service "/etc/init.d/nxlog start" and I'm get the following error: " Starting nxlog deamon... /usr/bin/nxlog: symbol lookup error: /usr/bin/nxlog: undefiend symbol: apr_pool_create_unmanaged_ex   " Does anyone have an idea?

super17 created
Replies: 1
View post »
last updated
Centralizing logs
Hello, I'm having trouble centralize logs because my storage system performs poorly. I have several nxlog-ce agents sending logs with om_tcp module and server I have a nxlog-ce recording these logs with the module om_file in a shared directory on my NAS. What recommendation for improving the performance of my solution as a whole? Use another distributed file system? Using an unstructured database? Exsitem more options? Obs .: I need to be able to retrieve the log in its original format, I need to be fault-tolerant and I need to have high write performance.

tiago_nascimento created
Remove duplicates in text file
I'm using NXLog to read a log file and send it to Logstash.  This works fine, but some of the log lines are duplicates.  They're in separate lines, but the content is exactly the same.  I can't change the way the logs are written to the log file, so the only way is to fix it either with NXLog before it gets send, or in Logstash when it arrives, which I prefer not to do. I see NXLog does have a function for this, but it's not working for me.  I've tried this in my config file. <Processor norepeat> Module pm_norepeat </Processor> <Route 1> Path in => norepeat => out </Route> This is abviously not working for me, am I maybe missing something here?

RVZ created
Replies: 1
View post »
last updated
ERROR unexpected data from server (64 bytes)
So i have configured nxlog with https to talk with logstash.  I got an error on nxlog side " ERROR unexpected data from server (64 bytes)"  I looked it up and it looks like nxlog got https://github.com/lamby/pkg-nxlog-ce/blob/master/src/modules/output/http/om_http.c#L6462  So i did check up the http input on logstash side , but i have not understand it  https://github.com/logstash-plugins/logstash-input-http#L118 Looks like logstash should send respond code, but i dont see it. Remember i dont have ruby skills.  Can someone explain to me what might be wrong here ? Or how to fix this issue ?

Tuxizm created
Replies: 1
View post »
last updated
NXLog Parsing XML
I've seen some posts from about a year ago that NXLog is unable to parse attributes using xm_xml, I just wanted to check if this is still true? I am running NXLog as a service on Windows machines and want to be able to parse the following message, is it possible? <log4j:event logger="com.sentry.test.LogContextListener" timestamp="1437661699866" level="TRACE" thread="localhost-startStop-1"> <log4j:message><![CDATA[This is a trace message about how we should use C#]]></log4j:message> </log4j:event>

Jakauppila created
Replies: 1
View post »
last updated
Filtering event logs
Hi guys, could You please share experience on filtering windows event logs. I have the folowing configuration in input tag: Query <QueryList>\ <Query Id="0">\ <Select Path="Application">*</Select>\ <Select Path="System">*</Select>\ <Select Path="Security">*</Select>\ </Query>\ </QueryList> # For windows 2003 and earlier use the following: #   Module      im_mseventlog #Exec if ($raw_event =~ /INFO\s+62464/) drop(); # Query za event logove (uzima samo definirane) #Query <QueryList>\ #<Query Id='1'>\ #<Select Path='Application'>*[System[(EventID='32068')]]</Select>\ #<Select Path='System'>*[System[(EventID='7001')]]</Select>\ #</Query>\ #</QueryList> ## Level 1 (ID=30  Critical)     severity level events # Level 2 (ID=40  Error)        severity level events # Level 3 (ID=50  Warning)      severity level events # Level 4 (ID=80  Information)  severity level events # Level 5 (ID=100 Verbose)      severity level events # Drop 4, i 5 level severity logs Exec if ($EventType == 'VERBOSE') OR ($EventType == 'Verbose') drop(); Exec if ($EventType == 'INFORMATION') OR ($EventType == 'Information') drop(); Exec if $raw_event =~ /INFO\s+4648/ drop(); .. I planed to filter specific events by entering name of 'eventtype' as in the example above. I would like to filter all Verbose,Information, and Warning levels. This unfortunately doesnt filter security INFORMATION level. Could You please please give proper example of filtering logs by severity  and by specific event_ID? Thank you very much. Appreciate the help.

bgrzinic created
Replies: 1
View post »
last updated
nxLog Community Edition License details
I am working in Product development company in india. I have downloaded nxlog community edition and setup to transfer our logs into logstash server. Our environment details as below. OS - Windows 7 Professional. nxLog installed as service.   Everything working as we expected. Now what i want to ask is, can we take this setup into our production environment?  Is Community edition fully free of cost or is there any license has to be purchase for this (nxLog Community edition)? Please give us license details about nxLog community edtion in Production environment.    Thanks Sugumar J  

Sugumar created
Replies: 1
View post »
last updated
om_ssl loses data
I have a stack of  nxlog -> om_ssl -> tcp input ->logstash.  And after i do kill -9 i lose a bunch of messages. i looked up buffered data in logstash and switch it to 1. tested it and if i read file i can lose about max 5 messages. So i tried to look up in nxlog, data_timeout is there 30 sec.  so as i looked up with data lose over time  it looks it might be it. Is there a chance to change this value after installing rpm ?  or i have to compile it with changed value in the code.  

Tuxizm created
Replies: 1
View post »
last updated
IIS logs via network share
Hi, is it possiable to access IIS logs located on a network share?  for example, right now I'm using:     Module    im_file     File    "D:\\Logs\\W3SVC1\\u_ex*"     SavePos  TRUE   and it works. But if i change it to:     Module    im_file     File    "\\netapp-ams-cifs\\IISlogs\\Trader1\\W3SVC1\\u_ex*"     SavePos  TRUE   i see an error on the nxlog saying: ERROR failed to open directory: \netapp-ams-cifs\IISlogs\Trader1\W3SVC1: The system cannot find the path specified.  Can anyone help please? Thanks

Rotema created
Replies: 1
View post »
last updated
RedHat NXlog RPM Dependency problem
Hey all, I'm trying to install nxlog rpm on redhat 6. Once I run the rpm I get error message :  " Failed dependencies: libdbi >= 0.8.1 is needed by nxlog-ce-2.9.1347-1.x86_64" When I'm trying install libdbi 0.8.1 I get error on   dependencies collision with a more advanced version of libdbi. The only way to continue the installation is to delete the newer version - and it is very problematic. Someone experienced the problem?   Thanks a lot.

super17 created
Replies: 1
View post »
last updated
where can I download 2.9.1347 sources?
On the site only source zip for version 2.8.1248 is available Thanks,   Angelo.

aturetta created
Replies: 1
View post »
last updated
Directory wildcards/following
Hi, I am evaluating nxlog on Windows but I've run into a snag. I have logs organized like this: D:\ServerLogs\2015-07-16\*.log Where the directory is rotated based on today's date. Now, if I use the recursive parameter set to true for the file watcher, including this D:\ServerLogs\*.log works. However, I don't want to include all files dues to size and/or relevance. I only want to include some of them. As far as I can gather, the recursive parameter only works when there's a wildcard on the filename. What I need is to be able to include the following: D:\ServerLogs\*\Log1.log so it follows the directory rotation on that file alone. I can't figure out how to accomplish this with nxlog. Please advise. Thank you.

phunqe created
Replies: 4
View post »
last updated