The log files are not providing me enough information to figure out whats wrong!!

Post a different question
8
responses

Here are the error messages:

2019-10-30 11:38:17 INFO nxlog-ce-2.10.2150 started
2019-10-30 11:38:22 WARNING stopping nxlog service
2019-10-30 11:38:22 WARNING nxlog-ce received a termination request signal, exiting...

Conf file:

define ROOT C:\Program Files (x86)\nxlog

Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.log

<Extension _gelf>
Module xm_gelf
</Extension>

<Input in>
Module im_msvistalog
ReadFromLast TRUE

# For windows 2003 and earlier use the following:
# Module im_mseventlog

Query <QueryList> \
<Query Id="0"> \
<Select Path="Application">*</Select> \
<Select Path="System">*</Select> \
<Select Path="Security">*</Select> \
</Query> \
</QueryList>
</Input>

<Output Graylog>
Module om_udp
Host secret
Port secret
OutputType GELF_UDP
</Output>

<Route 1>
Path in => Graylog
</Route>

AskedOctober 30, 2019 - 8:10pm

Comments (8)

  • mpark916's picture

    2019-11-01 10:43:20 DEBUG worker 0 processing event 0x3e838
    2019-11-01 10:43:20 DEBUG evaluating expression 'field' at C:\Program Files (x86)\nxlog\conf\nxlog.conf:48
    2019-11-01 10:43:20 DEBUG PROCESS_EVENT: MODULE_RESUME (in)
    2019-11-01 10:43:20 DEBUG RESUME: in
    2019-11-01 10:43:20 DEBUG not resuming stopped module in
    2019-11-01 10:43:20 DEBUG worker 0 waiting for new event
    2019-11-01 10:43:20 DEBUG om_udp sent 934 bytes
    2019-11-01 10:43:20 DEBUG before nx_logqueue_pop, size: 2
    2019-11-01 10:43:20 DEBUG Graylog get_next_logdata: got (queuesize: 0)
    2019-11-01 10:43:20 DEBUG nx_event_to_jobqueue: DATA_AVAILABLE (Graylog)
    2019-11-01 10:43:20 DEBUG nx_event_to_jobqueue: MODULE_RESUME (in)
    2019-11-01 10:43:20 DEBUG event added to jobqueue
    2019-11-01 10:43:20 DEBUG executing statements
    2019-11-01 10:43:20 DEBUG worker 2 got signal for new job
    2019-11-01 10:43:20 DEBUG evaluating expression 'string literal' at C:\Program Files (x86)\nxlog\conf\nxlog.conf:48
    2019-11-01 10:43:20 DEBUG worker 2 processing event 0x3e8e0
    2019-11-01 10:43:20 DEBUG evaluating expression 'field' at C:\Program Files (x86)\nxlog\conf\nxlog.conf:48
    2019-11-01 10:43:20 DEBUG PROCESS_EVENT: MODULE_RESUME (in)
    2019-11-01 10:43:20 DEBUG RESUME: in
    2019-11-01 10:43:20 DEBUG not resuming stopped module in
    2019-11-01 10:43:20 DEBUG worker 2 waiting for new event
    2019-11-01 10:43:20 DEBUG om_udp sent 815 bytes
    2019-11-01 10:43:20 DEBUG before nx_logqueue_pop, size: 1
    2019-11-01 10:43:20 DEBUG Graylog get_next_logdata: got NULL (queuesize: 0)
    2019-11-01 10:43:20 DEBUG nx_event_to_jobqueue: MODULE_RESUME (in)
    2019-11-01 10:43:20 DEBUG event added to jobqueue
    2019-11-01 10:43:20 DEBUG worker 0 got signal for new job
    2019-11-01 10:43:20 DEBUG worker 0 processing event 0x3ed78
    2019-11-01 10:43:20 DEBUG worker 1 processing event 0x3de60
    2019-11-01 10:43:20 DEBUG PROCESS_EVENT: MODULE_RESUME (in)
    2019-11-01 10:43:20 DEBUG PROCESS_EVENT: DATA_AVAILABLE (Graylog)
    2019-11-01 10:43:20 DEBUG RESUME: in
    2019-11-01 10:43:20 DEBUG om_udp_write
    2019-11-01 10:43:20 DEBUG not resuming stopped module in
    2019-11-01 10:43:20 DEBUG Graylog get_next_logdata: got NULL (queuesize: 0)
    2019-11-01 10:43:20 DEBUG worker 0 waiting for new event
    2019-11-01 10:43:20 DEBUG nx_event_to_jobqueue: MODULE_RESUME (in)
    2019-11-01 10:43:20 DEBUG event added to jobqueue
    2019-11-01 10:43:20 DEBUG worker 2 got signal for new job
    2019-11-01 10:43:20 DEBUG worker 2 processing event 0x3eb80
    2019-11-01 10:43:20 DEBUG worker 1 processing event 0x3e8a8
    2019-11-01 10:43:20 DEBUG PROCESS_EVENT: MODULE_RESUME (in)
    2019-11-01 10:43:20 DEBUG PROCESS_EVENT: MODULE_STOP (Graylog)
    2019-11-01 10:43:20 DEBUG RESUME: in
    2019-11-01 10:43:20 DEBUG STOP: Graylog
    2019-11-01 10:43:20 DEBUG not resuming stopped module in
    2019-11-01 10:43:20 DEBUG worker 2 waiting for new event
    2019-11-01 10:43:20 DEBUG worker 1 processing event 0x3ec60
    2019-11-01 10:43:20 DEBUG PROCESS_EVENT: DATA_AVAILABLE (Graylog)
    2019-11-01 10:43:20 DEBUG om_udp_write
    2019-11-01 10:43:20 DEBUG module Graylog is not running, not reading any more data
    2019-11-01 10:43:20 DEBUG worker 1 waiting for new event
    2019-11-01 10:43:20 DEBUG no events or no future events, event thread sleeping in condwait
    2019-11-01 10:43:20 DEBUG stopping EXTENSION modules
    2019-11-01 10:43:20 DEBUG stopping module _gelf
    2019-11-01 10:43:20 DEBUG nx_event_to_jobqueue: MODULE_STOP (_gelf)
    2019-11-01 10:43:20 DEBUG event added to jobqueue
    2019-11-01 10:43:20 DEBUG worker 0 got signal for new job
    2019-11-01 10:43:20 DEBUG worker 0 processing event 0x3eb80
    2019-11-01 10:43:20 DEBUG PROCESS_EVENT: MODULE_STOP (_gelf)
    2019-11-01 10:43:20 DEBUG STOP: _gelf
    2019-11-01 10:43:20 DEBUG worker 0 waiting for new event
    2019-11-01 10:43:20 DEBUG no events or no future events, event thread sleeping in condwait
    2019-11-01 10:43:20 DEBUG no events or no future events, event thread sleeping in condwait
    2019-11-01 10:43:20 DEBUG stopping module fileop
    2019-11-01 10:43:20 DEBUG nx_event_to_jobqueue: MODULE_STOP (fileop)
    2019-11-01 10:43:20 DEBUG event added to jobqueue
    2019-11-01 10:43:20 DEBUG worker 2 got signal for new job
    2019-11-01 10:43:20 DEBUG worker 2 processing event 0x3ede8
    2019-11-01 10:43:20 DEBUG PROCESS_EVENT: MODULE_STOP (fileop)
    2019-11-01 10:43:20 DEBUG STOP: fileop
    2019-11-01 10:43:20 DEBUG worker 2 waiting for new event
    2019-11-01 10:43:20 DEBUG no events or no future events, event thread sleeping in condwait
    2019-11-01 10:43:20 DEBUG no events or no future events, event thread sleeping in condwait
    2019-11-01 10:43:20 DEBUG worker 2 got signal for new job
    2019-11-01 10:43:20 DEBUG worker 2 got no event to process
    2019-11-01 10:43:20 DEBUG event_thread still running, waiting for threads to exit
    2019-11-01 10:43:20 DEBUG worker 0 got signal for new job
    2019-11-01 10:43:20 DEBUG worker 0 got no event to process
    2019-11-01 10:43:20 DEBUG worker 1 got signal for new job
    2019-11-01 10:43:20 DEBUG worker 1 got no event to process
    2019-11-01 10:43:20 DEBUG worker thread 2 exiting
    2019-11-01 10:43:20 DEBUG worker thread 0 exiting
    2019-11-01 10:43:20 DEBUG worker thread 1 exiting
    2019-11-01 10:43:20 DEBUG data_available() == FALSE, processing finished
    2019-11-01 10:43:20 DEBUG event thread exiting
    2019-11-01 10:43:21 DEBUG shutdown_modules: INPUT
    2019-11-01 10:43:21 DEBUG SHUTDOWN: in
    2019-11-01 10:43:21 DEBUG shutdown_modules: PROCESSOR
    2019-11-01 10:43:21 DEBUG shutdown_modules: OUTPUT
    2019-11-01 10:43:21 DEBUG SHUTDOWN: Graylog
    2019-11-01 10:43:21 DEBUG shutdown_modules: EXTENSION
    2019-11-01 10:43:21 DEBUG SHUTDOWN: _gelf
    2019-11-01 10:43:21 DEBUG SHUTDOWN: fileop
    2019-11-01 10:43:21 DEBUG nx_config_cache_write()
    2019-11-01 10:43:21 DEBUG config cache written to C:\Program Files (x86)\nxlog\data\configcache.dat
    2019-11-01 10:43:21 DEBUG nxlog_shutdown() leave
    2019-11-01 10:43:21 DEBUG service stopped

    This is probably only a 1/100th of the whole DEBUG log.

    November 1, 2019 - 7:22pm
  • mpark916's picture

    7 DEBUG executing statements
    2019-11-01 10:29:17 DEBUG before nx_logqueue_push, size: 76
    2019-11-01 10:29:17 DEBUG evaluating expression 'string literal' at C:\Program Files (x86)\nxlog\conf\nxlog.conf:48
    2019-11-01 10:29:17 DEBUG nx_event_to_jobqueue: DATA_AVAILABLE (Graylog)
    2019-11-01 10:29:17 DEBUG evaluating expression 'field' at C:\Program Files (x86)\nxlog\conf\nxlog.conf:48
    2019-11-01 10:29:17 DEBUG before nx_logqueue_push, size: 77
    2019-11-01 10:29:17 DEBUG nx_event_to_jobqueue: DATA_AVAILABLE (Graylog)
    2019-11-01 10:29:17 DEBUG no events or no future events, event thread sleeping in condwait
    2019-11-01 10:29:17 DEBUG om_udp sent 815 bytes
    2019-11-01 10:29:17 DEBUG before nx_logqueue_pop, size: 78
    2019-11-01 10:29:17 DEBUG Graylog get_next_logdata: got (queuesize: 76)
    2019-11-01 10:29:17 DEBUG nx_event_to_jobqueue: DATA_AVAILABLE (Graylog)
    2019-11-01 10:29:17 WARNING nxlog-ce received a termination request signal, exiting...
    2019-11-01 10:29:17 DEBUG before nx_logqueue_push, size: 77
    2019-11-01 10:29:17 DEBUG nxlog_shutdown() enter
    2019-11-01 10:29:17 DEBUG executing statements
    2019-11-01 10:29:17 DEBUG stopping INPUT modules
    2019-11-01 10:29:17 DEBUG nx_event_to_jobqueue: DATA_AVAILABLE (Graylog)
    2019-11-01 10:29:17 DEBUG stopping module in
    2019-11-01 10:29:17 DEBUG evaluating expression 'string literal' at C:\Program Files (x86)\nxlog\conf\nxlog.conf:48
    2019-11-01 10:29:17 DEBUG nx_event_to_jobqueue: MODULE_STOP (in)
    2019-11-01 10:29:17 DEBUG evaluating expression 'field' at C:\Program Files (x86)\nxlog\conf\nxlog.conf:48
    2019-11-01 10:29:17 DEBUG event added to jobqueue
    2019-11-01 10:29:17 DEBUG worker 0 got signal for new job

    November 1, 2019 - 7:22pm
  • mpark916's picture

    Thank you b0ti. Would there be anyway to find out what is causing the service to stop?

    When I look at the logs they do not provide any information aside from that nxlog is stopping.

    2019-11-04 11:38:17 INFO nxlog-ce-2.10.2150 started
    2019-11-04 11:38:22 WARNING stopping nxlog service
    2019-11-04 11:38:22 WARNING nxlog-ce received a termination request signal, exiting...

    November 5, 2019 - 7:48pm
  • Zhengshi's picture
    (NXLog)

    You could check in Windows Event Log to see if there is any data recorded, or enable auditing of services and then check the Event Log.
    There are various EventID's that track service stopped events throughout the different Windows product lines. 7036,7040, 4689/4546 for auditing, etc.

    On our side, we don't record which app sends termination signal or which user.

    November 7, 2019 - 4:33am

Answers (0)