There are several reasons you might want to start a particular NXLog module with a delay.
You can think of it like delaying the start of a Windows service.
In most cases, you need to do this for performance reasons.
But there might be other scenarios where you would want to do this, such as collecting logs during a specific time frame.
If you have, for example, a less critical module block, you can prioritize the more important one by delaying the less important one.
As mentioned, this is common practice in operating systems, and the main principle is the same when using NXLog.
In the following example, the module we’ll stop and start is called input.
It is referenced in Exec input→module_stop();, and in the <Input input> opening clause of the input module.
You must schedule operations externally to the module (i.e. from the Exec module block).
If you schedule within the input module (in this case), the module will not start at the set time because it is in a stopped state, and so it can’t start up again.
You can use a Schedule block inside an Exec block to achieve the delayed start of a particular module.
This configuration uses two separate Schedule blocks; the first stops the referenced module when NXLog starts up, and logs the information that the module is blocked.
The second Schedule block sets the module to start at the next whole minute after NXLog started using a cron schedule expression, which, in this case, runs the operation every minute.
To avoid this and only run it once, the RunCount directive is specified.
Exec log_info("=========== The input module is stopped ===========");
When */1 * * * *
Exec log_info("=========== The input module is started ===========");
The following is the NXLog log output from running this operation.
2023-01-23 02:33:00 INFO [CORE|main] nxlog-5.6.7727 (50b2a4353@REL_v5.6) started on Windows
2023-01-23 02:33:00 INFO [om_tcp|output] connecting to 192.168.88.148:1514
2023-01-23 02:33:00 INFO [om_tcp|output] tcp connection established with 192.168.88.148:1514
2023-01-23 02:33:00 INFO [xm_exec|exec] =========== The input module is stopped ===========
2023-01-23 02:34:00 INFO [xm_exec|exec] =========== The input module is started ===========
You can schedule a larger time frame to suit your needs better.
This configuration delays the start of the defined module by 1-59 seconds, depending on when NXLog was started.
You could get the time from the OS to get more exact timing, but that would be different for every operating system type.
This NXLog configuration works regardless of the operating system used.
You can use the same technique to stop and start any NXLog module at any time.
NXLog Ltd. develops multi-platform log collection tools that support many
different log sources, formats, transports, and integrations. The tools help
administrators collect, parse, and forward logs so they can more easily
respond to security issues, investigate operational problems, and analyze
event data. NXLog distributes the free and open source
NXLog Community Edition and
offers additional features and support with the
NXLog Enterprise Edition.
This document is provided for informational purposes only and is subject to
change without notice.
Trademarks are the properties of their respective owners.