responses
I am getting an error message to nxlog.log.
2015-02-17 08:16:23 INFO nxlog-ce-2.8.1248 started
2015-02-17 08:16:35 ERROR Couldn't read next event, corrupted eventlog?; The data is invalid.
And after this error no more events or log messages are generated.
However I can read event log with event viewer and I can see new events.
These are messages in my graylog2:
2015-02-17 08:16:35.000 wintoosa Couldn't read next event, corrupted eventlog? The data is inval
2015-02-17 08:16:23.000 wintoosa nxlog-ce-2.8.1248 started
Seems that nxlog is running but it can't handle events after this error.
How can I fix this ?
My very basic nxlog.conf:
define ROOT C:\Program Files (x86)\nxlog
Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.log
#LogLevel DEBUG
<Extension syslog>
Module xm_syslog
</Extension>
<Extension gelf>
Module xm_gelf
</Extension>
<Input internal>
Module im_internal
</Input>
<Input eventlog>
Module im_msvistalog
# For windows 2003 and earlier use the following:
# Module im_mseventlog
</Input>
<Output out>
Module om_udp
Host 10.0.0.103
Port 12900
outputType GELF
</Output>
<Route 1>
Path internal, eventlog => out
</Route>
Comments (7)
I tested with EE but I'll get the same error.
I even cleared all event logs with event viewer yesterday.
2015-02-18 10:36:25 INFO nxlog-ce-2.8.1248 started
2015-02-18 10:36:27 ERROR Couldn't read next event, corrupted eventlog?; The data is invalid.
2015-02-18 10:57:36 WARNING stopping nxlog service
2015-02-18 10:57:36 WARNING nxlog-ce received a termination request signal, exiting...
2015-02-18 11:01:53 INFO nxlog-2.8.1337-trial started
2015-02-18 11:02:35 ERROR Couldn't read next event, corrupted eventlog?; The data is invalid.
Windows 8.1 is fresh installation without any further application installation (except Windows updates).
So I am unable to use nxlog with Windows 8.1 at the moment.
A fresh install of English Windows 8.1 Enterprise build 9600 works ok with nxlog-ce-2.8.1248, just tested it in a VM. This issue is also Windows 8.1, so I suspect there may be something with 8.1 but it is likely an issue with some windows 8 eventlog source and is not an NXLog bug.
What you could try is to specify specific sources only:
If it works with these, you can keep on adding more sources until the offending source is found.
See this mailing list post for some more info.
Here is some content in log file. Loglevel DEBUG.
When the first event comes after starting nxlog, log shows:
no events or no future events, event thread sleeping in condwait
nxlog doesn't recognise new events.
2015-02-18 12:41:59 DEBUG no events or no future events, event thread sleeping in condwait
2015-02-18 12:41:59 DEBUG worker 2 got signal for new job
2015-02-18 12:41:59 DEBUG worker 2 processing event 0xa518c0
2015-02-18 12:41:59 DEBUG PROCESS_EVENT: READ (eventlog)
2015-02-18 12:41:59 DEBUG im_msvistalog checking for new events...
2015-02-18 12:41:59 DEBUG im_msvistalog read 0 events
2015-02-18 12:41:59 DEBUG worker 2 waiting for new event
2015-02-18 12:41:59 DEBUG new event in event_thread [eventlog:READ]
2015-02-18 12:41:59 DEBUG future event, event thread sleeping 1000000ms in cond_timedwait
2015-02-18 12:42:00 DEBUG new event in event_thread [eventlog:READ]
2015-02-18 12:42:00 DEBUG nx_event_to_jobqueue: READ (eventlog)
2015-02-18 12:42:00 DEBUG event added to jobqueue
2015-02-18 12:42:00 DEBUG no events or no future events, event thread sleeping in condwait
2015-02-18 12:42:00 DEBUG worker 1 got signal for new job
2015-02-18 12:42:00 DEBUG worker 1 processing event 0xa518f8
2015-02-18 12:42:00 DEBUG PROCESS_EVENT: READ (eventlog)
2015-02-18 12:42:00 DEBUG im_msvistalog checking for new events...
2015-02-18 12:42:00 DEBUG before nx_logqueue_push, size: 0
2015-02-18 12:42:00 DEBUG nx_event_to_jobqueue: DATA_AVAILABLE (out)
2015-02-18 12:42:00 DEBUG event added to jobqueue
2015-02-18 12:42:00 ERROR [im_msvistalog.c:779/im_msvistalog_read()] Couldn't read next event, corrupted eventlog?; The data is invalid.
2015-02-18 12:42:00 DEBUG worker 1 processing event 0x3f7240
2015-02-18 12:42:00 DEBUG PROCESS_EVENT: DATA_AVAILABLE (out)
2015-02-18 12:42:00 DEBUG om_udp_write
2015-02-18 12:42:00 DEBUG out get_next_logdata: got (queuesize: 0)
2015-02-18 12:42:00 DEBUG nx_event_to_jobqueue: DATA_AVAILABLE (out)
2015-02-18 12:42:00 DEBUG event added to jobqueue
2015-02-18 12:42:00 DEBUG nx_event_to_jobqueue: MODULE_RESUME (eventlog)
2015-02-18 12:42:00 DEBUG event added to jobqueue
2015-02-18 12:42:00 DEBUG nx_event_to_jobqueue: MODULE_RESUME (internal)
2015-02-18 12:42:00 DEBUG event added to jobqueue
2015-02-18 12:42:00 DEBUG om_udp sent 289 bytes
2015-02-18 12:42:00 DEBUG before nx_logqueue_pop, size: 1
2015-02-18 12:42:00 DEBUG out get_next_logdata: got NULL (queuesize: 0)
2015-02-18 12:42:00 DEBUG nx_event_to_jobqueue: MODULE_RESUME (eventlog)
2015-02-18 12:42:00 DEBUG nx_event_to_jobqueue: MODULE_RESUME (internal)
2015-02-18 12:42:00 DEBUG worker 1 processing event 0x3f6af0
2015-02-18 12:42:00 DEBUG PROCESS_EVENT: MODULE_RESUME (internal)
2015-02-18 12:42:00 DEBUG RESUME: internal
2015-02-18 12:42:00 DEBUG module internal already running, skipping resume
2015-02-18 12:42:00 DEBUG worker 1 processing event 0x3f6ab8
2015-02-18 12:42:00 DEBUG PROCESS_EVENT: MODULE_RESUME (eventlog)
2015-02-18 12:42:00 DEBUG RESUME: eventlog
2015-02-18 12:42:00 DEBUG module eventlog already running, skipping resume
2015-02-18 12:42:00 DEBUG worker 1 processing event 0xa518d0
2015-02-18 12:42:00 DEBUG PROCESS_EVENT: DATA_AVAILABLE (out)
2015-02-18 12:42:00 DEBUG om_udp_write
2015-02-18 12:42:00 DEBUG out get_next_logdata: got NULL (queuesize: 0)
2015-02-18 12:42:00 DEBUG nx_event_to_jobqueue: MODULE_RESUME (eventlog)
2015-02-18 12:42:00 DEBUG event added to jobqueue
2015-02-18 12:42:00 DEBUG nx_event_to_jobqueue: MODULE_RESUME (internal)
2015-02-18 12:42:00 DEBUG event added to jobqueue
2015-02-18 12:42:00 DEBUG worker 1 processing event 0x3f6998
2015-02-18 12:42:00 DEBUG PROCESS_EVENT: MODULE_RESUME (internal)
2015-02-18 12:42:00 DEBUG RESUME: internal
2015-02-18 12:42:00 DEBUG module internal already running, skipping resume
2015-02-18 12:42:00 DEBUG worker 1 processing event 0x3f7240
2015-02-18 12:42:00 DEBUG PROCESS_EVENT: MODULE_RESUME (eventlog)
2015-02-18 12:42:00 DEBUG RESUME: eventlog
2015-02-18 12:42:00 DEBUG module eventlog already running, skipping resume
2015-02-18 12:42:00 DEBUG worker 1 waiting for new event
2015-02-18 12:42:00 DEBUG worker 0 got signal for new job
2015-02-18 12:42:00 DEBUG worker 0 got no event to process
2015-02-18 12:42:00 DEBUG worker 0 waiting for new event
2015-02-18 12:42:00 DEBUG worker 2 got signal for new job
2015-02-18 12:42:00 DEBUG worker 2 got no event to process
2015-02-18 12:42:00 DEBUG worker 2 waiting for new event
2015-02-18 12:42:00 DEBUG no events or no future events, event thread sleeping in condwait
2015-02-18 12:42:00 DEBUG no events or no future events, event thread sleeping in condwait
2015-02-18 12:42:00 DEBUG no events or no future events, event thread sleeping in condwait
2015-02-18 12:42:01 DEBUG no events or no future events, event thread sleeping in condwait
2015-02-18 12:42:01 DEBUG no events or no future events, event thread sleeping in condwait
The events that the the debug log refers to are internal nxlog events, not events in the EventLog.
no error by changing to the older module.
However, I've only recieved 1 log event so far. so we'll see
With the im_mseventlog module on Windows Vista and later it is only possible to collect a subset of the events.