Monitor the file modification date with nxlog?

Post a different question
5
responses

Hello

Is it possible to monitor the log file modification date? I do not want to check log file contents, to check whether pattern was found or not. The only thing which I want to is to get modification date of a log file, and if it's older than X minutes -> generate an event.

I tried different configs, with schedule, with im_null modules, exec, file_mtime function... And nothing... Still doesn't work.

AskedDecember 22, 2017 - 10:50am

Answer (1)

The easiest would be to create a script (shell, perl, python, whatever) that check this in a loop periodically via stat and then emits the message. Then configure im_exec to run this.

AnsweredDecember 22, 2017 - 10:55am

Comments (4)

  • cps86's picture

    Thanks for the reply.

    Yes, I wanted to do that as a last resort.

    According to the documentation there's following function: datetime file_mtime(string file) Return the last modification time of file. On error undef is returned and an error is logged.

    It is possible to use that function in the Schedule block?

    December 22, 2017 - 11:00am
  • b0ti's picture
    (NXLog)

    Something like if file_mtime("file") - now() > 42 log_info("file is old"); should be possible from <Schedule>.

    This will end up in nxlog.log and also in im_internal but you can't inject a message currently any other way.

    December 22, 2017 - 11:04am
  • cps86's picture

    Hello

    I made up my mind to use im_exec in my script. How to periodically execute the external app? It seems that Schedule block doesn't work:

    User nxlog
Group nxlog

LOGFILE /var/log/nxlog/nxlog.log
LogLevel INFO
<Extension fileop>
        Module xm_fileop
</Extension>

<Input input>
    Module im_exec
    Command /bin/echo
    Arg "test"
    <Schedule>
            Every 5 sec
            Exec log_info("scheduled execution at " + now());
    </Schedule>
</Input>

<Output fileout>
        Module om_file
        File "/tmp/output.txt"
</Output>
<Route 1>
        Path input => fileout
</Route>

    "Test" string was wrote in the /tmp/output.txt only once. What I'm doing wrong ? Is even possible? Should I create a loop within my script/external app? After moving Command & Arg to Schedule block it tells me that Command is a unknown im_exec operation.

    January 5, 2018 - 12:51pm