5
responses

Hello

Is it possible to monitor the log file modification date? I do not want to check log file contents, to check whether pattern was found or not. The only thing which I want to is to get modification date of a log file, and if it's older than X minutes -> generate an event.

I tried different configs, with schedule, with im_null modules, exec, file_mtime function... And nothing... Still doesn't work.

AskedDecember 22, 2017 - 10:50am

Answer (1)

The easiest would be to create a script (shell, perl, python, whatever) that check this in a loop periodically via stat and then emits the message. Then configure im_exec to run this.

Comments (4)

  • cps86's picture

    Thanks for the reply.

    Yes, I wanted to do that as a last resort.

    According to the documentation there's following function: datetime file_mtime(string file) Return the last modification time of file. On error undef is returned and an error is logged.

    It is possible to use that function in the Schedule block?

  • b0ti's picture
    (NXLog)

    Something like if file_mtime("file") - now() > 42 log_info("file is old"); should be possible from <Schedule>.

    This will end up in nxlog.log and also in im_internal but you can't inject a message currently any other way.

  • cps86's picture

    Hello

    I made up my mind to use im_exec in my script. How to periodically execute the external app? It seems that Schedule block doesn't work:

    User nxlog
    Group nxlog
    
    LOGFILE /var/log/nxlog/nxlog.log
    LogLevel INFO
    <Extension fileop>
            Module xm_fileop
    </Extension>
    
    <Input input>
        Module im_exec
        Command /bin/echo
        Arg "test"
        <Schedule>
                Every 5 sec
                Exec log_info("scheduled execution at " + now());
        </Schedule>
    </Input>
    
    <Output fileout>
            Module om_file
            File "/tmp/output.txt"
    </Output>
    <Route 1>
            Path input => fileout
    </Route>
    

    "Test" string was wrote in the /tmp/output.txt only once. What I'm doing wrong ? Is even possible? Should I create a loop within my script/external app? After moving Command & Arg to Schedule block it tells me that Command is a unknown im_exec operation.