Log Rotation Causing nxlog Failure

Question

I'm using nxlog to watch two vCenter log files on a Windows Server 2008 system and I have a very simple config to ship messages to Logstash. Nxlog began failing yesterday after a file was rotated. Here's my config:

<Extension syslog>
    Module      xm_syslog
</Extension>

<Input in1>
    Module      im_file
    File        "C:\ProgramData\VMware\VMware VirtualCenter\Logs\vpxd-[0-5][0-9].log"
    SavePos     TRUE
</Input>

<Input in2>
    Module      im_file
    File        "C:\ProgramData\VMware\VMware VirtualCenter\Logs\vpxd-alert-[0-5][0-9].log"
    SavePos     TRUE
</Input>

<Processor buffer1>
    Module  pm_buffer
    MaxSize 1024
    Type    Mem
    WarnLimit   512
</Processor>

<Processor buffer2>
    Module  pm_buffer
    MaxSize 1024
    Type    Mem
    WarnLimit   512
</Processor>

<Output out1>
    Module      om_udp
    Host        <ip>
    Port        514
</Output>

<Output out2>
    Module      om_udp
    Host        <ip>
    Port        514
</Output>

<Route 1>
    Path        in1 => buffer1 => out1
</Route>

<Route 2>
    Path        in2 => buffer2 => out2
</Route>

vCenter log rotation is a bit odd so I'm thinking that it's at least partially causing this problem. You can see from above the filename I'm watching. This file is created as vpxd-01.log and increments up from there. The files are rotated when they hit 50MB and old logs get compressed after two new files are created, e.g. vpxd-03 is created and vpxd-01 gets compressed.

But yesterday the first file that nxlog had started watching (since being installed last week) was rotated, causing this error:

2013-12-28 19:41:08 WARNING input file does not exist: C:\ProgramData\VMware\VMware VirtualCenter\Logs\vpxd-47.log

It repeats 12 times across the next 24 hours and then nxlog failed entirely until I restarted the service yesterday morning.

Hopefully my explanation makes sense. I ended up losing about six hours of logs so I want to make sure this doesn't happen again. Does anybody have any solution or suggestions?

You can try to change your configuration from a specific log file to the directory where the logs are created. — , Jan 07 '14 at 08:56
I'm only wanting to log two specific vCenter log files: vpxd-xx.log and vpxd-alert-xx.log. The vCenter log directory contains quite a few other logs that I don't care about so that prevents me from setting the directory instead of the specific files in the nxlog config. — HarryTruman, Jan 09 '14 at 14:59

score 0 · Answer 1 · answered Feb 03 '14 at 14:49

0

Try using this input instead instead of hard defining [0-5][0-9]:

<Input in2>
    Module      im_file
    File        "C:\ProgramData\VMware\VMware VirtualCenter\Logs\vpxd-*.log"
    SavePos     TRUE
</Input>

answered Feb 03 '14 at 14:49

tkrn

159
1
9

There are other files in that log directory that are named similarly. For instance, vpxd-alerts and vpxd-profiler, with each also having digits after the filename. – HarryTruman Feb 05 '14 at 20:56

Log Rotation Causing nxlog Failure

1 Answers1