3
responses

Hi,
I am monitoring few log file on a windows 2012 server using im_file
Send them to an ELK cluster

When checking the indexed logs we noticed delays ( 30 sec or more) for some ( not all)
The only clue I have found is a bunch of this type of error

2019-01-28 14:50:01 DEBUG future event, event thread sleeping 34361ms in cond_timedwait

Any idea what that means and how to troubleshoot it ??

Many thanks
Steven

AskedFebruary 5, 2019 - 1:37pm

Comments (2)

  • stef97's picture

    we are using entreprise version 3.1.1903

    other maybe relevant error is this
    “2019-01-28 14:50:01 DEBUG not checking file c:\MedAvail\Logs\SoftwareDeploymentDetails.log until blacklisting expires

    why would a file be blacklisted ?

    Here is an excerpt from nxlog.conf

    # ConfigurationService
    <Input %MODULE2%>
    Module im_file
    BufferSize 1500000
    ReadFromLast True
    SavePos True
    InputType multi
    Exec %DROP_EMPTYROWS%
    Exec %BUILD_EVENTTIME%
    Exec %SET_HOST%
    Exec %CONVERTXFIELDS%
    Exec %SET_LOGENTRY%
    File 'e:\MedAvail\Logs\%MODULE2%.log'
    Exec $sindex = '%MODULE2%';
    </Input>

Answer (1)