I got to set up a log forwarding to a syslog-server. I managed everthing to work except one thing.

The newest event at the end of the logfile has no CR, CRLF, LF or something similar. When a event occurs it is processed when the next event occurs ...

How can I make NXLog to read and process to the end of the file (EOF) in case the file has changed?
So far I uses the im_file module.

Thank you for you help

AskedFebruary 14, 2020 - 6:26pm

Comments (7)

  • Arkadiy's picture

    Hello Daniel,

    Could you share your config along with example of the file you taking events from?

    Best regards, Arch

    February 15, 2020 - 12:36am
  • platypus4u's picture

    Hello Arch

    Thank you for your answer:

    This is my Input and Output:

    <Input in_teamviewer>
    Module im_file
    File 'C:\Users\User01\AppData\Local\Temp\TeamViewer\Connections_incoming.txt'
    SavePos TRUE
    ReadFromLast TRUE
    PollInterval 10
    $Hostname = hostname();
    $SeverityValue = 5;
    $MessageSourceAddress = hostname();
    $SyslogFacilityValue = 4;
    $SourceName = 'TeamViewer';
    $EventTime = parsedate($5 + '-' + $4 + '-' + $3 + ' ' + $6);
    $user = $2;
    $raw = replace($raw_event, "\t", "|");
    log_info('processed Message: ' + $raw + '|' + '%USERNAME%' + '|' + '['+ file_name() + ']');
    if ($raw_event == '') $Message = $raw + '|' + '%USERNAME%' + '|'+ "Teamviewer Login Event";
    else $Message = $raw + '|' + '%USERNAME%' + '|' + '['+ file_name() + ']';

    <Output out_syslog>
    Module om_udp
    Host x.x.x.x
    Port 514

    <Route 1>
    Path in_teamviewer => out_syslog

    And here you get an example of the monitored logfile (Connections_incoming.txt, starting with an empty line and nothing like CRLF at the end of the last line):

    xxxxxxxxx WS001 05-12-2019 10:09:04 05-12-2019 10:36:56 user01 RemoteControl {rtertze-hpohrt944-fghj-dgjdjghjjfgj}
    YYYYYYYYYY WS002 14-02-2020 13:51:43 14-02-2020 13:51:55 user02 RemoteControl {43u003gd-gh63-5456-46nf-ghzuzuesszsu}

    As I tried to describe it works basically. I only don't get the most current event. This comes finally when the Line has become a CRLF with the next event.

    Do you understand my description? Sorry for my English ...


    February 17, 2020 - 8:13am
  • Arkadiy's picture

    Hello Daniel,

    Don't worry about description, it's nice and clear, but I couldn't reproduce it.
    Could you please attach a file with described behavior? Because it could be a thing with copy-paste, I want to exclude it.

    Best regards, Arch

    February 18, 2020 - 10:12am
  • platypus4u's picture

    Hello Arch

    I wanted to upload an example file but I'm afraid I'm not able. How can I attach a file in this forum?


    February 18, 2020 - 1:27pm
  • Arkadiy's picture


    Sorry, I forgot that there is no way for this forum to attach a file.
    Could you please drop it to me on arkadiy.kulikov@nxlog.com?

    Regards, Arch

    February 18, 2020 - 11:24pm
  • platypus4u's picture

    Hi Arch
    Did you get the file?


    February 21, 2020 - 10:59pm
  • Arkadiy's picture

    Hi Daniel,

    I'm sorry, I misspelled my own mailbox (shame), could you please send logs to arkadiy.kulikov@nxlog.org?

    Sincerely, Arch

    February 21, 2020 - 11:19pm

Answers (0)