Hi,
Probably loganalyzer (and its rsyslog backend?) will treat all lines as a
separate event.
You need to add "InputType multiline" to the im_file instance, otherwise
the extension module will not be used.
Then you can either replace all line breaks with a space or tab, or forward
it in a format which is suitable for sending messages containing line
breaks. See *Example 6.24. Forwarding IETF syslog over TCP* in the
reference manual for a possible solution.
The "bug" you are referring to in the second part is actually a feature,
since "\t" is a tab character and that's why the file path becomes invalid.
You should enclose the file path in single quotes, i.e. 'C:\....' or use
double backslash to escape it.
Regards,
Botond
On Wed, Aug 21, 2013 at 11:27 AM, Aurélien BOUVARD <[email protected]>wrote:
> hi all,
>
> i actually use a solution based on nxlog (client side) and loganalizer
> (server side) to send my oracle logs (Windows) to loganalyser (On CenOS)
>
> My Oracle logs (from alert_xe.log) looks like this :
>
> Tue Aug 20 16:34:19 2013
> OER 6666 in Load Indicator : Error Code = OSD-04500: illegal option
> specified
> O/S-Error: (OS 2) Fonction incorrecte. !
> Tue Aug 20 16:40:05 2013
> OER 6666 in Load Indicator : Error Code = OSD-04500: illegal option
> specified
> O/S-Error: (OS 2) Fonction incorrecte. !
>
>
> i would like to send each block separated. To do this , i thank to build a
> regex to found the header "Tue Aug 20 16:34:19 2013" and so send this
> block:
>
> Tue Aug 20 16:34:19 2013
> OER 6666 in Load Indicator : Error Code = OSD-04500: illegal option
> specified
> O/S-Error: (OS 2) Fonction incorrecte. !
>
>
> and , when my regex find an other occurence of this header , it will send
>
> Tue Aug 20 16:40:05 2013
> OER 6666 in Load Indicator : Error Code = OSD-04500: illegal option
> specified
> O/S-Error: (OS 2) Fonction incorrecte. !
>
>
> i try to do this configuration:
>
>
>
> ## This is a sample configuration file. See the nxlog reference manual
> about the
> ## configuration options. It should be installed locally and is also
> available
> ## online at http://nxlog.org/nxlog-docs/en/nxlog-reference-manual.html
>
> ## Please set the ROOT to the folder your nxlog was installed into,
> ## otherwise it will not start.
>
> #define ROOT C:\Program Files\nxlog
> define ROOT C:\Program Files (x86)\nxlog
>
> Moduledir %ROOT%\modules
> CacheDir %ROOT%\data
> Pidfile %ROOT%\data\nxlog.pid
> SpoolDir %ROOT%\data
> LogFile %ROOT%\data\nxlog.log
>
> <Extension multiline>
> Module xm_multiline
> HeaderLine /^\w\w\w\s\w\w\w\s\d\d\s\d\d:\d\d:\d\d\s\d\d\d\d/
> </Extension>
> <Input in>
> Module im_file
> File "C:\alert_xe.log"
> </Input>
>
> <Output out>
> Module om_tcp
> Host /*IP_OF_SERVER*/
> Port 514
> </Output>
>
>
> <Route 1>
> Path in => out
> </Route>
>
>
> But when i do this , i receive each line separated in loganalyser..even if
> i have my regex and the multiline module...
>
> So i would like know how to resolve this problem :(
>
> PS: I put a copy (for testing) of alert_xe.log in "C:\" directory ,
> because i found a bug.
>
> When i try to put the real path for alert_xe.log (File
> "C:\oraclexe\app\oracle\diag\rdbms\xe\xe\trace\alert_xe.log") , i see this
> in the log:
>
> 2013-08-21 11:22:55 ERROR failed to open
> C:\oraclexe\app\oracle\diag;dbms\xe\xe race\alert_xxe.log; La syntaxe du
> nom de fichier, de répertoire ou de volume est incorrecte.
> 2013-08-21 11:22:55 INFO connecting to 192.168.152.203:514
> 2013-08-21 11:22:55 INFO nxlog-ce-2.5.1089 started
> 2013-08-21 11:22:56 ERROR apr_stat failed on file
> C:\oraclexe\app\oracle\diag;dbms\xe\xe race\alert_xxe.log; La syntaxe du
> nom de fichier, de répertoire ou de volume est incorrect
>
>
> of course my path is incorrect..because something change the path i wrote
> as you see...and i can't find why and how to resolve it.
>
> I really hope someone have a solution for this 2 problems...or any idea
>
> Regards,
>
>
>
>
>
>
>
> ------------------------------------------------------------------------------
> Introducing Performance Central, a new site from SourceForge and
> AppDynamics. Performance Central is your source for news, insights,
> analysis and resources for efficient Application Performance Management.
> Visit us today!
> http://pubads.g.doubleclick.net/gampad/clk?id=48897511&iu=/4140/ostg.clktrk
> _______________________________________________
> nxlog-ce-users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/nxlog-ce-users
>
>
------------------------------------------------------------------------------
Introducing Performance Central, a new site from SourceForge and
AppDynamics. Performance Central is your source for news, insights,
analysis and resources for efficient Application Performance Management.
Visit us today!
http://pubads.g.doubleclick.net/gampad/clk?id=48897511&iu=/4140/ostg.clktrk
_______________________________________________
nxlog-ce-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/nxlog-ce-users
