8
responses

Hi
I got to set up a log forwarding to a syslog-server. I managed everthing to work except one thing.

The newest event at the end of the logfile has no CR, CRLF, LF or something similar. When a event occurs it is processed when the next event occurs ...

How can I make NXLog to read and process to the end of the file (EOF) in case the file has changed?
So far I uses the im_file module.

Thank you for you help
Daniel

AskedFebruary 14, 2020 - 6:26pm

Comments (8)

  • platypus4u's picture

    Hello Arch

    Thank you for your answer:

    This is my Input and Output:

    <Input in_teamviewer>
    Module im_file
    File 'C:\Users\User01\AppData\Local\Temp\TeamViewer\Connections_incoming.txt'
    SavePos TRUE
    ReadFromLast TRUE
    PollInterval 10
    <Exec>
    $Hostname = hostname();
    $SeverityValue = 5;
    $MessageSourceAddress = hostname();
    $SyslogFacilityValue = 4;
    $SourceName = 'TeamViewer';
    $EventTime = parsedate($5 + '-' + $4 + '-' + $3 + ' ' + $6);
    $user = $2;
    $raw = replace($raw_event, "\t", "|");
    log_info('processed Message: ' + $raw + '|' + '%USERNAME%' + '|' + '['+ file_name() + ']');
    if ($raw_event == '') $Message = $raw + '|' + '%USERNAME%' + '|'+ "Teamviewer Login Event";
    else $Message = $raw + '|' + '%USERNAME%' + '|' + '['+ file_name() + ']';
    to_syslog_bsd();
    </Exec>
    </Input>

    <Output out_syslog>
    Module om_udp
    Host x.x.x.x
    Port 514
    </Output>

    <Route 1>
    Path in_teamviewer => out_syslog
    </Route>

    And here you get an example of the monitored logfile (Connections_incoming.txt, starting with an empty line and nothing like CRLF at the end of the last line):

    xxxxxxxxx WS001 05-12-2019 10:09:04 05-12-2019 10:36:56 user01 RemoteControl {rtertze-hpohrt944-fghj-dgjdjghjjfgj}
    YYYYYYYYYY WS002 14-02-2020 13:51:43 14-02-2020 13:51:55 user02 RemoteControl {43u003gd-gh63-5456-46nf-ghzuzuesszsu}

    As I tried to describe it works basically. I only don't get the most current event. This comes finally when the Line has become a CRLF with the next event.

    Do you understand my description? Sorry for my English ...

    Daniel

  • Arkadiy's picture
    (NXLog)

    Hello Daniel,

    Don't worry about description, it's nice and clear, but I couldn't reproduce it.
    Could you please attach a file with described behavior? Because it could be a thing with copy-paste, I want to exclude it.

    Best regards, Arch

  • Arkadiy's picture
    (NXLog)

    Daniel,

    Sorry, I forgot that there is no way for this forum to attach a file.
    Could you please drop it to me on arkadiy.kulikov@nxlog.com?

    Regards, Arch

Answers (0)