Is it possible to monitor the log file modification date? I do not want to check log file contents, to check whether pattern was found or not. The only thing which I want to is to get modification date of a log file, and if it's older than X minutes -> generate an event.

I tried different configs, with schedule, with im_null modules, exec, file_mtime function... And nothing... Still doesn't work.

AskedDecember 22, 2017 - 10:50am

Answer (1)

The easiest would be to create a script (shell, perl, python, whatever) that check this in a loop periodically via stat and then emits the message. Then configure im_exec to run this.

Comments (4)

  • cps86's picture

    Thanks for the reply.

    Yes, I wanted to do that as a last resort.

    According to the documentation there's following function: datetime file_mtime(string file) Return the last modification time of file. On error undef is returned and an error is logged.

    It is possible to use that function in the Schedule block?

  • b0ti's picture

    Something like if file_mtime("file") - now() > 42 log_info("file is old"); should be possible from <Schedule>.

    This will end up in nxlog.log and also in im_internal but you can't inject a message currently any other way.

  • cps86's picture


    I made up my mind to use im_exec in my script. How to periodically execute the external app? It seems that Schedule block doesn't work:

    User nxlog
    Group nxlog
    LOGFILE /var/log/nxlog/nxlog.log
    LogLevel INFO
    <Extension fileop>
            Module xm_fileop
    <Input input>
        Module im_exec
        Command /bin/echo
        Arg "test"
                Every 5 sec
                Exec log_info("scheduled execution at " + now());
    <Output fileout>
            Module om_file
            File "/tmp/output.txt"
    <Route 1>
            Path input => fileout

    "Test" string was wrote in the /tmp/output.txt only once. What I'm doing wrong ? Is even possible? Should I create a loop within my script/external app? After moving Command & Arg to Schedule block it tells me that Command is a unknown im_exec operation.