nxlog module delayed start

There are several reasons you might want to start a particular NXLog module with a delay. You can think of it like delaying the start of a Windows service. In most cases, you need to do this for performance reasons. But there might be other scenarios where you would want to do this, such as collecting logs during a specific time frame. If you have, for example, a less critical module block, you can prioritize the more important one by delaying the less important one. As mentioned, this is common practice in operating systems, and the main principle is the same when using NXLog.

Note

  • In the following example, the module we’ll stop and start is called input. It is referenced in Exec input→module_stop();, and in the <Input input> opening clause of the input module.

  • You must schedule operations externally to the module (i.e. from the Exec module block). If you schedule within the input module (in this case), the module will not start at the set time because it is in a stopped state, and so it can’t start up again.

You can use a Schedule block inside an Exec block to achieve the delayed start of a particular module.

nxlog.conf

This configuration uses two separate Schedule blocks; the first stops the referenced module when NXLog starts up, and logs the information that the module is blocked. The second Schedule block sets the module to start at the next whole minute after NXLog started using a cron schedule expression, which, in this case, runs the operation every minute. To avoid this and only run it once, the RunCount directive is specified.

<Extension exec>
    Module    xm_exec

    <Schedule>
        When        @startup
        Exec        input->module_stop();
        Exec        log_info("=========== The input module is stopped ===========");
    </Schedule>

    <Schedule>
        When        */1 * * * *
        Exec        input->module_start();
        Exec        log_info("=========== The input module is started ===========");
        RunCount    1
    </Schedule>

</Extension>

<Input input>
    Module    im_testgen
    Exec      log_info($raw_event);
</Input>

The following is the NXLog log output from running this operation.

2023-01-23 02:33:00 INFO [CORE|main] nxlog-5.6.7727 (50b2a4353@REL_v5.6) started on Windows
2023-01-23 02:33:00 INFO [om_tcp|output] connecting to 192.168.88.148:1514
2023-01-23 02:33:00 INFO [om_tcp|output] tcp connection established with 192.168.88.148:1514
2023-01-23 02:33:00 INFO [xm_exec|exec] =========== The input module is stopped ===========
2023-01-23 02:34:00 INFO [xm_exec|exec] =========== The input module is started ===========

You can schedule a larger time frame to suit your needs better. This configuration delays the start of the defined module by 1-59 seconds, depending on when NXLog was started. You could get the time from the OS to get more exact timing, but that would be different for every operating system type. This NXLog configuration works regardless of the operating system used.

You can use the same technique to stop and start any NXLog module at any time.

NXLog Platform is an on-premises solution for centralized log management with
versatile processing forming the backbone of security monitoring.

With our industry-leading expertise in log collection and agent management, we comprehensively
address your security log-related tasks, including collection, parsing, processing, enrichment, storage, management, and analytics.

Start free Contact us
Share
Related Posts