4
responses

Seeing the following errors in the logs on a WIN 2008 R2 machine. Not 100% sure why but is seems to happen intermittently, I can't seem to corrolate it with log file rotations or anything like that.

2017-03-31 12:46:52 ERROR if-else failed at line 10, character 39 in C:\Program Files (x86)\nxlog/conf/app_log/application_log_multiline_extensions.conf. statement execution has been aborted; binary operation failed at line 10, character 36 in C:\Program Files (x86)\nxlog/conf/app_log/application_log_multiline_extensions.conf. expression evaluation has been aborted; missing logdata, no field available in this context at line 10, character 19 in C:\Program Files (x86)\nxlog/conf/app_log/application_log_multiline_extensions.conf. operation possibly after drop()

hen it starts to appear it always happens at the exact same second of a given minute, but the number of minutes in between each erros seems somewhat random

ie.

2017-03-31 10:37:42 ERROR if-else failed at line 16...

2017-03-31 10:40:42 ERROR if-else failed at line 16 ...

2017-03-31 10:41:42 ERROR if-else failed at line 16...

Config would be similar to below.

<Extension app_log_multiline>
Module xm_multiline
Exec if \$raw_event =~ /^\s*\$/ drop();
</Extension>

<Input in_app_log_files>
Module im_file
File '%APP_LOGS_DIR%\server_error.log'
SavePos TRUE
InputType app_log_multiline
PollInterval 5
DirCheckInterval 60
CloseWhenIdle TRUE
<Exec>
\$Environment = "%ENVIRONMENT_TAG%";
\$Application = "%APP_TAG%";
\$Service = "%SERVICE_TAG%";
</Exec>
</Input>

• Actually I am seeing some unusual "Inode changed" messages where the file clearly hasn't been rotated so might be related to that somehow, but in many cases it happens without any "inode change" messages at all