7
responses

if I start nxlog manul from the command line like

/opt/nxlog/bin/nxlog -c      # RedHat7

everything works fine ; it reads the input logs from the positions when stopped. if I start it as service

systemctl start nxlog

then it ignores all the records of the input logs written while it was stopped. at my input definitions I have

SavePos          TRUE
ReadFromLast     TRUE

any help is welcomed, thanks, G. Bouras

AskedJune 21, 2019 - 11:19am

Answer (1)

It will only remember the last positions if it was able to save it in configcache.dat file when you stop it. Can you check that this file is created on shutdown?

Comments (6)

  • GeorgeBouras's picture

    Yes the file

    /opt/nxlog/var/spool/nxlog/configcache.dat
    

    is created, at

    systemctl stop nxlog
    

    but I do not know if the offsets there are updated as should. the service is started as root ( the command also) The same behavior on different redhat / centos boxes It is the nxlog EE ( registered) I have tried numerous

    /usr/lib/systemd/system/nxlog.service
    

    variations without success

    my input

    # Linux log files
    
    <Exec>
    $source_env    = 'dev';
    $source_server = hostname_fqdn();
    $source_ip     = host_ip();
    if $raw_event  =~/^\s*$/ { drop(); }
    if $raw_event  =~/^\s*#/ { drop(); }
    if file_name() =~/([^\/]+)$/ {$logfile=$1;}
    rename_field('SourceModuleName'  , 'source_type');
    rename_field('EventReceivedTime' , 'timestamp_collect'); 
    delete('SourceModuleType');
    </Exec>  
    
    Module           im_file
    InputType        LineBased
    SavePos          TRUE
    ReadFromLast     TRUE
    Recursive        FALSE
    RenameCheck      FALSE
    PollInterval     1
    ActiveFiles      15
    DirCheckInterval 180
    
    File '/var/log/messages'
    File '/var/log/secure'
    File '/var/log/audit/audit.log'
    File '/var/log/dmesg'
    File '/var/log/boot.log'
    File '/var/log/yum.log'
    File '/var/log/tuned/tuned.log'
    File '/var/log/cron'
    File '/var/log/spooler'
    File '/var/log/maillog'
    

    Thanks, G. Bouras

  • GeorgeBouras's picture

    I tried your "magical" work around and worked , thanks !
    I wonder if this directive produce such faulty behavior, why it was there at the first place.