Seeing the following errors in the logs on a WIN 2008 R2 machine. Not 100% sure why but is seems to happen intermittently, I can't seem to corrolate it with log file rotations or anything like that. 

2017-03-31 12:46:52 ERROR if-else failed at line 10, character 39 in C:\Program Files (x86)\nxlog/conf/app_log/application_log_multiline_extensions.conf. statement execution has been aborted; binary operation failed at line 10, character 36 in C:\Program Files (x86)\nxlog/conf/app_log/application_log_multiline_extensions.conf. expression evaluation has been aborted; missing logdata, no field available in this context at line 10, character 19 in C:\Program Files (x86)\nxlog/conf/app_log/application_log_multiline_extensions.conf. operation possibly after drop()

hen it starts to appear it always happens at the exact same second of a given minute, but the number of minutes in between each erros seems somewhat random 


2017-03-31 10:37:42 ERROR if-else failed at line 16...

2017-03-31 10:40:42 ERROR if-else failed at line 16 ...

2017-03-31 10:41:42 ERROR if-else failed at line 16...

Config would be similar to below.

<Extension app_log_multiline>
    Module xm_multiline
    HeaderLine /.*\[\d\d \w\w\w \d\d\d\d/
    Exec if $raw_event =~ /^\s*$/ drop();


<Input in_app_log_files>
    Module im_file
    File '%APP_LOGS_DIR%\server_error.log'
    SavePos TRUE
    ReadFromLast TRUE 
    InputType app_log_multiline
    PollInterval 5
    DirCheckInterval 60
    CloseWhenIdle TRUE
        $Environment = "%ENVIRONMENT_TAG%"; 
        $Application = "%APP_TAG%"; 
        $Service = "%SERVICE_TAG%";


AskedMarch 31, 2017 - 2:19pm

Comments (1)

  • smythmark's picture

    Actually I am seeing some unusual "Inode changed" messages where the file clearly hasn't been rotated so might be related to that somehow, but in many cases it happens without any "inode change" messages at all

Answer (1)

I'm not sure if the "inode change" messages are related but it looks like the if-else statement execution errors are caused by a bug due to drop() being called in xm_multiline. This will be fixed in the next EE version.

Comments (2)

  • b0ti's picture

    I see that this is now fixed in or development branch. I think the new build for the stable version of the EE containing the fix can be provided by early next week.