3
responses
responses
2021-04-25 00:00:00 INFO LogFile C:\Program Files (x86)\nxlog\data\nxlog.log reopened
2021-04-25 00:00:14 ERROR apr_stat failed on file C:\Windows\Sysnative\dhcp\DhcpSrvLog-Sun.log; Access is denied.
2021-04-25 00:00:16 WARNING input file was deleted: C:\Windows\Sysnative\dhcp\DhcpSrvLog-Sun.log
2021-04-26 00:00:45 ERROR apr_stat failed on file C:\Windows\Sysnative\dhcp\DhcpSrvLog-Mon.log; Access is denied.
2021-04-26 00:00:47 WARNING input file was deleted: C:\Windows\Sysnative\dhcp\DhcpSrvLog-Mon.log
Comments (2)
Hi Rafal,
The user does have access. The config which I am using for DHCP is as below
<Input DHCP_IN>
Module im_file
File 'C:\Windows\Sysnative\dns\dns.log'
SavePos TRUE
InputType LineBased
Exec if $raw_event == '' drop();
Exec $SourceName = "DHCPLog";$Message = $raw_event
</Input>
Hello,
are you sure it is exactly the same config that you're using? There're several issues, please check it & confirm.
For instance, missing event info in quote:
Exec if $raw_event == '' drop();
missing semicolon ad the end of Exec block:
Exec $SourceName = "DHCPLog";$Message = $raw_event;
and at the end - the warning message clearly refers to another file - in conf, it's supposed to be
File 'C:\Windows\Sysnative\dns\dns.log'
, whileWarning
indicates DHCP logs.Best regards,
Rafal