The NXLog team is constantly improving the quality of NXLog Enterprise Edition and will soon introduce a new major release - NXLog Enterprise Edition 6.0. This release will bring a large number of changes and it is important to correctly adapt your current configuration when upgrading your system.
We strongly recommend testing NXLog Enterprise Edition 6.0 operation on a smaller set of devices before commiting to a full-scale upgrade of your complete system. In case of any unexpected system behavior please contact us. Our experts are always happy to help!
The following list includes the most important changes coming in NXLog Enterprise Edition 6.0. System operators and administrators should check their configurations and change them accordingly.
From NXLog Enterprise Edition 6.0 onwards the LogqueueSize parameter is measured in bytes (the default value being 2MB) instead of the number of message batches. If you are using this parameter, ensure you adjust the value when upgrading.
The parameter should be set carefully as it directly affects the amount of RAM taken by pm and om modules. For more information, see the detailed description of the log queue mechanism.
Module pm_filter is now obsolete and removed from the package. Filtering is now possible in any module using a conditional drop() procedure in Exec blocks or directives. For more information, see the filter documentation.
Modules pm_transformer, pm_ts, and om_eventdb are now obsolete and have been removed from the package.
Module xm_admin is being extensively modified and reworked. If you are using the xm_admin API directly please keep in mind that there will be a number of changes in the serverInfo response. For more information, see the xm_admin documentation.
The handling of the $raw_event field has changed for both im and om modules, and now follows these rules:
All input modules set the $raw_event field.
All structured input modules set the $raw_event field according to a specific universal schema.
An empty $raw_event field will make all output modules ineffective.
$Hostname is now a core field. This means that client operating systems should be able to resolve 127.0.0.1 into a specific name. If the operating system cannot properly resolve it, the name should be added to the hosts file.
The im_msvistalog module now processes EventData and Userdata fields, creating the appropriate structures in the answer structure.
Hopefully changes to your configuration are easy and quick to apply, and you’ll be able to upgrade from NXLog Enterprise Edition 5 to NXLog Enterprise Edition 6 smoothly to benefit from all of the new features. Remember, in case of any unexpected system behavior please contact us.
NXLog Ltd. develops multi-platform log collection tools that support many
different log sources, formats, transports, and integrations. The tools help
administrators collect, parse, and forward logs so they can more easily
respond to security issues, investigate operational problems, and analyze
event data. NXLog distributes the free and open source
NXLog Community Edition and
offers additional features and support with the
NXLog Enterprise Edition.
This document is provided for informational purposes only and is subject to
change without notice.
Trademarks are the properties of their respective owners.