There are several reasons you might want to start a particular NXLog module with a delay. You can think of it like delaying the start of a Windows service. In most cases, you need to do this for performance reasons. But there might be other scenarios where you would want to do this, such as collecting logs during a specific time frame. If you have, for example, a less critical module block, you can prioritize the more important one by delaying the less important one. As mentioned, this is common practice in operating systems, and the main principle is the same when using NXLog.
|
Note
|
|
You can use a Schedule block inside an Exec block to achieve the delayed start of a particular module.
This configuration uses two separate Schedule blocks; the first stops the referenced module when NXLog starts up, and logs the information that the module is blocked.
The second Schedule block sets the module to start at the next whole minute after NXLog started using a cron schedule expression, which, in this case, runs the operation every minute.
To avoid this and only run it once, the RunCount directive is specified.
<Extension exec>
Module xm_exec
<Schedule>
When @startup
Exec input->module_stop();
Exec log_info("=========== The input module is stopped ===========");
</Schedule>
<Schedule>
When */1 * * * *
Exec input->module_start();
Exec log_info("=========== The input module is started ===========");
RunCount 1
</Schedule>
</Extension>
<Input input>
Module im_testgen
Exec log_info($raw_event);
</Input>The following is the NXLog log output from running this operation.
2023-01-23 02:33:00 INFO [CORE|main] nxlog-5.6.7727 (50b2a4353@REL_v5.6) started on Windows
2023-01-23 02:33:00 INFO [om_tcp|output] connecting to 192.168.88.148:1514
2023-01-23 02:33:00 INFO [om_tcp|output] tcp connection established with 192.168.88.148:1514
2023-01-23 02:33:00 INFO [xm_exec|exec] =========== The input module is stopped ===========
2023-01-23 02:34:00 INFO [xm_exec|exec] =========== The input module is started ===========You can schedule a larger time frame to suit your needs better. This configuration delays the start of the defined module by 1-59 seconds, depending on when NXLog was started. You could get the time from the OS to get more exact timing, but that would be different for every operating system type. This NXLog configuration works regardless of the operating system used.
You can use the same technique to stop and start any NXLog module at any time.
