responses
Hello NXLog user,
I'm new to Nxlog and I'm looking to send the contents of files (*.log) located in a single directory to a Syslog Watcher server (snmpsoft).
A trace can be on one or multiple lines but each start of a new trace starts with the time.
Here is an example of a trace on one line (columns => time type severity thread file function content) :
17:13:00.000 APP__ WARNING 1aa20b54100 <capp.cpp:56> [[CApp::ExistInDirectory]] File 'tool.exe' not found in C:/prog
Here is an example of multiple traces and one on multiple line (columns => time type severity thread file function content) :
10:57:25.924 SQL__ ERROR__ 20d962b1270 <csqlquery.cpp:292> [[CSqlQuery::ErrQuery]] [cnx2238] [Microsoft][ODBC Driver 17 for SQL Server][SQL Server]Violation de la contrainte PRIMARY KEY « PK__T__3214EC27053CB3F2 ». Impossible d'insérer une clé en double dans l'objet « B.T ». Valeur de clé dupliquée : (44422). [Microsoft][ODBC Driver 17 for SQL Server][SQL Server]L'instruction a été arrêtée. QODBC3: Impossible d'exécuter l'instruction
* Source query *
..
* Query with values *
...
10:57:25.926 APP__ ERROR__ 20d962b1270 <chistosystemautomate.cpp:67> [[CHistoSystemAutomate::MsgReceivedSystem]] {
"code": 500004,
"details": "",
"message": "Impossible d'exécuter la requête SQL."
}
Nxlog.conf that I tried to do
Panic Soft
#NoFreeOnExit TRUE
define ROOT C:\Program Files (x86)\nxlog
define CERTDIR %ROOT%\cert
define CONFDIR %ROOT%\conf
define LOGDIR %ROOT%\data
define LOGFILE %ROOT%\data\nxlog.log
LogFile %LOGFILE%
Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
<Extension _syslog>
Module xm_syslog
</Extension>
<Input messages>
Module im_file
File "C:\Users\toto\Documents\nxlog\*.log"
Exec $Message = $raw_event;
</Input>
<Output tcp>
Module om_tcp
Host 0.0.0.0
Port 514
Exec to_syslog_bsd();
</Output>
<Output udp>
Module om_udp
Host 0.0.0.0
Port 514
Exec to_syslog_bsd();
</Output>
<Route messages_to_tcp>
Path messages => tcp
</Route>
<Route messages_to_udp>
Path messages => udp
</Route>
Can you help me to write the conf file.
A big thank you in advance
Christophe
Comments (2)
Hello,
someone can help me to find an error track (in input messages, in output udp, ...) 🙏
Thanks
Christophe
Since you're doing some matching, before outputting to tcp and udp, it may be beneficial to output to file first to ensure the proper formatting is taking place and you are capturing the events you want to capture. https://nxlog.co/documentation/nxlog-user-guide/forwarding.html#forwarding_files_sockets
You can also slim down the two route blocks by reducing them to a single route block if it makes more sense to you. https://nxlog.co/documentation/nxlog-user-guide/config-overview.html#config-overview-example-an-automatic-route-block