Having the below error when trying to config DHCP logging via NXLog CE

Post a different question
3
responses

2021-04-25 00:00:00 INFO LogFile C:\Program Files (x86)\nxlog\data\nxlog.log reopened
2021-04-25 00:00:14 ERROR apr_stat failed on file C:\Windows\Sysnative\dhcp\DhcpSrvLog-Sun.log; Access is denied.
2021-04-25 00:00:16 WARNING input file was deleted: C:\Windows\Sysnative\dhcp\DhcpSrvLog-Sun.log
2021-04-26 00:00:45 ERROR apr_stat failed on file C:\Windows\Sysnative\dhcp\DhcpSrvLog-Mon.log; Access is denied.
2021-04-26 00:00:47 WARNING input file was deleted: C:\Windows\Sysnative\dhcp\DhcpSrvLog-Mon.log

AskedApril 28, 2021 - 5:03am

Answer (1)

Hello,

It looks like you are running NXLog agent with user doesn't having access to files you're trying to monitor. Please, ensure your configuration is setup properly.

Best regards,
Rafal

AnsweredApril 28, 2021 - 11:10am

Comments (2)

  • Smitha H.C's picture

    Hi Rafal,

    The user does have access. The config which I am using for DHCP is as below
    <Input DHCP_IN>
    Module im_file
    File 'C:\Windows\Sysnative\dns\dns.log'
    SavePos TRUE
    InputType LineBased
    Exec if $raw_event == '' drop();
    Exec $SourceName = "DHCPLog";$Message = $raw_event
    </Input>

    April 29, 2021 - 1:09am
  • raf's picture
    (NXLog)

    Hello,

    are you sure it is exactly the same config that you're using? There're several issues, please check it & confirm.

    For instance, missing event info in quote:

    Exec if $raw_event == '' drop();

    missing semicolon ad the end of Exec block:

    Exec $SourceName = "DHCPLog";$Message = $raw_event;

    and at the end - the warning message clearly refers to another file - in conf, it's supposed to be File 'C:\Windows\Sysnative\dns\dns.log', while Warning indicates DHCP logs.

    Best regards,
    Rafal

    May 3, 2021 - 12:59pm