Hello! I updated my nxlog server to 4.6.4640, and today during the day I saw a new for me error in log file: 2020-03-02 18:03:01 WARNING nxlog received a termination request signal, exiting... 2020-03-02 18:03:11 ERROR failed to stop module in, module is busy 2020-03-02 18:03:16 ERROR Another instance is already running (pid 5075);Resource temporarily unavailable 2020-03-02 18:03:16 ERROR Another instance is already running (pid 5075);Resource temporarily unavailable 2020-03-02 18:03:16 ERROR Another instance is already running (pid 5075);Resource temporarily unavailable 2020-03-02 18:03:17 ERROR Another instance is already running (pid 5075);Resource temporarily unavailable 2020-03-02 18:03:17 ERROR Another instance is already running (pid 5075);Resource temporarily unavailable 2020-03-02 18:04:09 ERROR timed out waiting for threads to exit 2020-03-02 18:04:19 ERROR failed to shutdown module in, module is busy And nxlog server was down until I restarted it. This situation is repeated several times per hour. Please help. Thaks a lot!

Hi everybody! I have a problem with collecting logs. Сlient application logs: 2020-01-09 15:24:54 INFO connected to server OK 2020-01-09 15:25:22 INFO reconnecting in 1 seconds 2020-01-09 15:25:22 ERROR remote ssl socket was reset? (SSL_ERROR_SYSCALL with errno=9); End of file found TCP dump at the moment error: C: Client Hello S: Server Hello, Certificate, Certificate Request, Server Hello Done C: Certificate, Client Key Exchange, Certificat Verify, Change Cipher Spec, Encrypted Handshake Message S: New Session Ticket, Change Cipher Spec, Encrypted Handshake Message C: Application Data S: Encrypted Alert And part of the data segment is looped, the infinitely the same fragment of data is stored in the log file on the server side. How I may to detect the cause of this problem? I hope you help me, please. May be, I need to correct deep parameters of network settings? Thank you!

Hi, I'm trying to use nxlog to to extract three metrics from a .set file. My OS is Windows 10. I edited the .conf file in "C:\Program Files (x86)\nxlog\conf" and it looks like this: Panic Soft #NoFreeOnExit TRUE define ROOT C:\Program Files (x86)\nxlog define CERTDIR %ROOT%\cert define CONFDIR %ROOT%\conf define LOGDIR %ROOT%\data define LOGFILE %LOGDIR%\nxlog.log LogFile %LOGFILE% Moduledir %ROOT%\modules CacheDir %ROOT%\data Pidfile %ROOT%\data\nxlog.pid SpoolDir %ROOT%\data <Extension json> Module xm_json </Extension> <Extension sikora> Module xm_set Fields $Nominal, $PlusTol, $Oval # fields of interest (metrics) FieldTypes string, string, string # type of variable Delimiter ; EscapeControl FALSE </Extension> <Input sikora_logs> Module im_file File "C:\Users\50051145\Desktop\nx_log\\*.set" # imput file #ReadFromLast True #Recursive True #SavePos True ReadFromLast False Recursive False SavePos False &lt;Exec&gt; if $raw_event =~ /^Macrosezione : (.+)/ # creazione variabile { # create_var('macrosection'); # set_var('macrosection', $1); # drop(); # } sikora-&gt;parse_set(); delete($EventReceivedTime); delete($SourceModuleName); delete($SourceModuleType); if $raw_event =~ /^Operatore / { # variable definition for the if not defined get_var('start_time') # timestamp { # log_debug(&quot;parsed_time: &quot; + strptime($time, &quot;%d/%m/%Y %I:%M:%S&quot;)); # create_var('start_time'); # set_var('start_time', strptime($time, &quot;%d/%m/%Y %I:%M:%S&quot;)); drop(); } else { if get_var('start_time') != strptime($time,&quot;%d/%m/%Y %I:%M:%S&quot;) { log_debug(&quot;old_time: &quot; + get_var('start_time')); log_debug(&quot;new_time: &quot;, $time); set_var('start_time', strptime($time,&quot;%d/%m/%Y %I:%M:%S&quot;)); drop(); } } } $time = (integer(get_var('start_time')) / 1000000 + integer($time)) * 1000; # formula to convert timestamp in milliseconds $pressure = integer($pressure); $macrosection = get_var('macrosection'); $nominal = get_var('nominal'); $type = get_var('type'); to_json(); &lt;/Exec&gt; </Input> <Output out> Module om_file # CreateDir TRUE # File "C:\Users\50051145\Desktop\temp" + $fileName # output file </Output> <Route 1> Path sikora_logs => out </Route> When I run the program I expect an output file in a folder on my desktop "C:\Users\50051145\Desktop\temp" but I get nothing. I checked the logs and I get this: 2019-09-10 18:20:34 ERROR Failed to load module from C:\Program Files (x86)\nxlog\modules\extension\xm_set.dll, The specified module could not be found. ; The specified module could not be found. 2019-09-10 18:20:34 ERROR Failed to load module from C:\Program Files (x86)\nxlog\modules\output\om_file #.dll, The specified module could not be found. ; The specified module could not be found. 2019-09-10 18:20:34 ERROR Couldn't parse Exec block at C:\Program Files (x86)\nxlog\conf\nxlog.conf:38; couldn't parse statement at line 45, character 28 in C:\Program Files (x86)\nxlog\conf\nxlog.conf; module sikora not found 2019-09-10 18:20:34 ERROR module 'sikora_logs' has configuration errors, not adding to route '1' at C:\Program Files (x86)\nxlog\conf\nxlog.conf:93 2019-09-10 18:20:34 ERROR module 'out' is not declared at C:\Program Files (x86)\nxlog\conf\nxlog.conf:93 2019-09-10 18:20:34 ERROR route 1 is not functional without input modules, ignored at C:\Program Files (x86)\nxlog\conf\nxlog.conf:93 2019-09-10 18:20:34 WARNING no routes defined! 2019-09-10 18:20:34 WARNING not starting unused module sikora_logs 2019-09-10 18:20:34 INFO nxlog-ce-2.10.2150 started 2019-09-11 11:10:27 WARNING stopping nxlog service 2019-09-11 11:10:27 WARNING nxlog-ce received a termination request signal, exiting... It appers that xm_set.dll library is missing, "The specified module could not be found". I found out in "C:\Program Files (x86)\nxlog\modules\extension" that nxlog doesn't come with a .set library. How can I add this library ? Thank you

Hi everyone! The new version NXLog works well. But recently, I again saw an error during the rotation of log. Service does not work. I reinstalled it and everything is ok. Thanks everyone! 2019-08-18 00:00:00 ERROR failed to check whether file 'C:\nxlog\data\nxlog.log.2' exists; Access is denied. 2019-08-19 00:00:00 ERROR Scheduled execution failed; procedure 'file_cycle' failed at line 27, character 57 in C:\nxlog\conf\nxlog.conf. statement execution has been aborted; ### ASSERTION FAILED at line 76 in filepath.c/nx_filepath_find_all_paths(): "path_decomposed->nelts > 0" ### 2019-08-20 00:00:00 ERROR Scheduled execution failed; procedure 'file_cycle' failed at line 27, character 57 in C:\nxlog\conf\nxlog.conf. statement execution has been aborted; ### ASSERTION FAILED at line 76 in filepath.c/nx_filepath_find_all_paths(): "path_decomposed->nelts > 0" ### 2019-08-21 00:00:00 ERROR Scheduled execution failed; procedure 'file_cycle' failed at line 27, character 57 in C:\nxlog\conf\nxlog.conf. statement execution has been aborted; ### ASSERTION FAILED at line 76 in filepath.c/nx_filepath_find_all_paths(): "path_decomposed->nelts > 0" ###

Hi everybody! Today I found in the logs of NXLog 4.3.4308 Server very odd error: 2019-06-12 11:22:04 ERROR failed to open file <FILE> when trying to truncate: Too many open files The service was not working at this time until I has restarted it. Could you be please so kind tell me what is the limit of opened files? What's the number simultaneous connections can the service hold? Thanks!

Hi everybody, I have a very mystical case and I need your help, please: I have nxlog server nxlog-3.2.2016-1.x86_64 I installed a update to latest version of nxlog server (nxlog-4.1.4016-1.x86_64) Config for clients was not change. In the logfile of nxlog server I see many errors and nxlog do not save data: 2018-09-25 10:50:32 ERROR zlib decompression error, data error (Z_DATA_ERROR) incorrect header check If I did downgrade version, this problem is go, everything is ok. What's happened?! Please, help me.

Hello, We're testing nxlog and at least a few times per day it's throwing this error. When this happens the error repeats itself in the logs for a few hours until either the log fills up the  partition or the kernel kills nxlog due to memory running out (Out of memory: Kill process 2422 (nxlog) score 762 or sacrifice child). I'm not a C programmer but looking at the om_dbi driver source it seems to me as if this assertion might be checking if the length of the SQL query is longer than a predefined constant. Could this be the case? Is there a limit on the size of the SQL query nxlog can send? I think I might be wrong because I've hardcoded SQL queries I believe are longer than those triggering the assertion error and they went through just fine. I came across a thread on the same error and the poster stated they resolved the issue by recompiling nxlog from source. I did that but unfortunately the latest available source is from an older version and couldn't get our nxlog.conf to work with it. Any ideas what this assertion is checking? BTW, NXLog is running on CentOS 6.8 and there's plenty of free memory (8 GB) and CPU power available. Thank you, Babak B. 

I'm having an alert every time the om_http sends a message to a web service. Has anyone ever experienced this? LOG: 2015-08-19 16:45:18 INFO connecting to localhost:80 2015-08-19 16:45:18 WARNING http server disconnected while reading the response 2015-08-19 16:45:18 INFO reconnecting in 0 seconds CONF: <Output outATM>     Module              om_http     URL                 http://localhost:80/modules/AtmProcessorMT/index.php </Output>

I am using the following im_file configuration to try to collect Windows DHCP Server logs: ## Input module for Microsoft DHCP server audit logs <Input dhcp>     Module im_file     File "C:\\Windows\\System32\\Dhcp\\DhcpSrvLog-*.log"     SavePos TRUE     PollInterval 180     Exec to_syslog_bsd(); </Input> I also tried this without escaping the backslashes and even with "/" characters instead. I also tried using a specific filename but nothing seems to work, since I get the "input file does not exist" error. When I try the same config but with the location being at C:\Dhcp\DhcpSrvLog-*.log, everything works. nxlog service is being run as LocalSystem. Any hints on what I would need to do next to get the logs working from their native location?