1
response

Say I have the following nxlog.conf file:

<Input lc1>
Module im_file
File "/var/log/messages"
</Input>

<Input lc2>
Module im_file
File "/var/log/mything.txt"
</Input>

<Output fileout>
Module om_file
Exec if $Message =~ /error/ $SeverityValue = syslog_severity_value("error");
Exec to_syslog_bsd();
File "/var/log/logmsg2.txt"
</Output>

<Route lcroute1>
Path lc1 => fileout
</Route>

<Route lcroute2>
Path lc2 => fileout
</Route>

Is there a way to just turn off the harvesting of Ic2 or the lcroute2 without having to modify or manually change the nxlog.conf file? Basically for this example nxlog.conf file have fine-grained adjustment/control of the logs if someone decides they want to turn off a log getting routed to the output file.

Thank you!

AskedAugust 10, 2021 - 8:51pm

Comments (1)

  • carlos.caro's picture
    (NXLog)

    Hi Jay,

    You certainly need to modify the configuration file to achieve this, but to simplify things, create two (2) seperate configuration files with the Route block only, and then, make use of the include directive as follow to enable or disable an specific route:

    lcroute1.conf

    <Route lcroute1>
            Path lc1 => fileout
    </Route>
    

    lcroute2.conf

    <Route lcroute2>
            Path lc2 => fileout
    </Route>
    

    nxlog.conf (all routes included and enabled)

    ...
    <Input lc1>
            Module im_file
            File "/var/log/messages"
    </Input>
    
    <Input lc2>
            Module im_file
            File "/var/log/mything.txt"
    </Input>
    
    <Output fileout>
            Module om_file
            Exec if $Message =~ /error/ $SeverityValue = syslog_severity_value("error");
            Exec to_syslog_bsd();
            File "/var/log/logmsg2.txt"
    </Output>
    
    include /etc/nxlog/lcroute1.conf
    include /etc/nxlog/lcroute2.conf
    

    To disable route lcroute2, just comment out the lcroute2.conf line like:

    ...
    include /etc/nxlog/lcroute1.conf
    #include /etc/nxlog/lcroute2.conf
    

    And remember to restart the agent.

    Regards,
    Carlos.

Answers (0)