responses
I do use NXLog to parse the Exchange logs and send them to my Graylog. Time to time, Graylog still receive the line #Software: Microsoft Exchange...
Note that the line is sent once per hours or two hours.
It seems that the check if $raw_event =~ /^#/ drop(); fail to drop the #line randomly.
Bellow part of my config for the input:
<Input in_MSGTRK>
Module im_file
File "\\\\xxxxxxx\\d$\\Exchsvr\\TransportRoles\\Logs\\\MessageTracking\\\\*.log"
SavePos TRUE
ReadFromLast TRUE
Recursive TRUE
CloseWhenIdle TRUE
InputType LineBased
PollInterval 10
Exec if $raw_event =~ /HealthMailbox/ drop();
Exec if $raw_event =~ /^#/ drop();
Exec ParseEXCHANGESMSGTRK->parse_csv();
</Input>
Any clue, help or solution is welcome
Comments (3)
Actually I just checked and indeed it looks like Exchange Message Tracking logs have a UTF-8 BOM header. Can you try the following?
I changed the line to the one upper. I will let it run during Easter and see if I still get the error message.
Thanks. So far I do not have anymore the error and files seem to be properly parsed.