Hi Everyone,

New to nxlog, so apologies in advance! I am currently deploying nxlog on a Linux server (Red Hat Enterprise release 6.6). I am currently trying to remove a file after nxlog has finished processing. From the documentation, I am using file_remove, which is not working. Here is my config that does not throw any syntax errors when starting nxlog. In the debug log, I do not see an attempt to try and match files for removing:

<Extension fileop>
 Module   xm_fileop
        Every   1 min
        Exec    file_remove('/eventarchive/processed/*.raw', (now()));

I used this same syntax on a windows setup to test it, which worked - it successfully removed files. Does anyone know if there are any limitations with Linux that would stop this from working? Is there something I'm doing wrong?

As a side question, does anyone know the best way to configure nxlog to remove a file after processing, as opposed to setting a time interval like above?

Thanks in advance!




AskedMarch 29, 2016 - 1:01am

Answer (1)

file_remove() should work the same way on Linux. Do you see any errors in nxlog.log?

A simple EOF is usually not a sign of a finished log file, the source application might still append logs to the file any time later. For this reason currently im_file does not support executing actions when EOF is reached.

If you have a staging directory where files are moved which are never written to then you could simply write a script that reads the files, emits the contents on STDOUT and then removes the file. Something like this in shell:

while true; do
 for i in *.log; do
  cat $i; rm -f $i;
 sleep 1;

This can be invoked via im_exec. It's untested but it should give an idea.