not resume log files

Post a different question
7
responses

if I start nxlog manul from the command line like

/opt/nxlog/bin/nxlog -c      # RedHat7

everything works fine ; it reads the input logs from the positions when stopped. if I start it as service

systemctl start nxlog

then it ignores all the records of the input logs written while it was stopped. at my input definitions I have

SavePos          TRUE
ReadFromLast     TRUE

any help is welcomed, thanks, G. Bouras

AskedJune 21, 2019 - 11:19am

Answer (1)

It will only remember the last positions if it was able to save it in configcache.dat file when you stop it. Can you check that this file is created on shutdown?

AnsweredJune 21, 2019 - 11:42am

Comments (6)

  • GeorgeBouras's picture

    Yes the file

    /opt/nxlog/var/spool/nxlog/configcache.dat

    is created, at

    systemctl stop nxlog

    but I do not know if the offsets there are updated as should. the service is started as root ( the command also) The same behavior on different redhat / centos boxes It is the nxlog EE ( registered) I have tried numerous

    /usr/lib/systemd/system/nxlog.service

    variations without success

    my input

    # Linux log files

<Exec>
$source_env    = 'dev';
$source_server = hostname_fqdn();
$source_ip     = host_ip();
if $raw_event  =~/^\s*$/ { drop(); }
if $raw_event  =~/^\s*#/ { drop(); }
if file_name() =~/([^\/]+)$/ {$logfile=$1;}
rename_field('SourceModuleName'  , 'source_type');
rename_field('EventReceivedTime' , 'timestamp_collect'); 
delete('SourceModuleType');
</Exec>  

Module           im_file
InputType        LineBased
SavePos          TRUE
ReadFromLast     TRUE
Recursive        FALSE
RenameCheck      FALSE
PollInterval     1
ActiveFiles      15
DirCheckInterval 180

File '/var/log/messages'
File '/var/log/secure'
File '/var/log/audit/audit.log'
File '/var/log/dmesg'
File '/var/log/boot.log'
File '/var/log/yum.log'
File '/var/log/tuned/tuned.log'
File '/var/log/cron'
File '/var/log/spooler'
File '/var/log/maillog'

    Thanks, G. Bouras

    June 21, 2019 - 11:56am
  • GeorgeBouras's picture

    I tried your "magical" work around and worked , thanks !
    I wonder if this directive produce such faulty behavior, why it was there at the first place.

    June 23, 2019 - 11:34pm