Hi David, It looks like the windows network share has to do with this, although I'm not quite sure why the internal file pointer would be reset. This can normally only happen when the file is truncated. Obviously this needs some debugging effort to see why the windows network share behaves this way. Just to make sure IIS is not responsible for this, can you check if this is reproducible when you simply append to the file ? (i.e. echo "test" >> file.log)
Regards, Botond On Fri, 10 Oct 2014 12:21:11 +0100 "David Laing" <david.la...@cityindex.com> wrote: > Hi, > > I'm shipping IIS7 log files using nxlog-ce-2.8.1248 on a Windows machine. > The IIS7 log file exists on another Windows machine, and is being accessed > via a windows shared folder. > > The problem is that some of the lines from the IIS7 log file are shipped > twice - ie, I end up with duplicate log lines in shipped output. > > I've managed to reproduce the problem using the simple nxlog config below (in > production I ship to syslog; but the duplications also appear when shipping > to a out_file). I only need to run nxlog for about 30 seconds > before I get some duplication; so I don't think it has anything to do with > log file rotation. > > ------- > > LogLevel DEBUG > LogFile nxlog.log > > ModuleDir nxlog\modules > CacheDir . > PidFile nxlog.pid > SpoolDir . > > <Output out_file> > Module om_file > File "out.log" > </Output> > > <Input in_file9> > Module im_file > > File "\\\\SERVER_NAME\\Logs\\WEBL24 - CI > WEBSERVICE\W3SVC1\\u_ex141009.log" > </Input> > > <Route route_to_syslog> > Path in_file9 => out_file > </Route> > > ------- > > I can't find any errors or warnings that shed any light in nxlog.log (with > LogLevel==DEBUG) > > I can't replicate the error when shipping a local log file - only one over a > Windows network share. > > At this point I'm stuck; I don't know where else to look for more > information as to what could be going wrong. > > Any ideas on what could be wrong, or what extra information I can provide to > help diagnose the source of the error > would be much appreciated. > > Thanks! > > David Laing > City Index Ltd<br /> > > This email is intended only for the use of the individual or entity to which > it is addressed and may contain information that is confidential, subject to > copyright or which constitutes a trade secret. You should not copy it for any > purpose or disclose its contents to any person. City Index Ltd has taken > reasonable precautions to minimise the risk of transmitting software viruses > but we advise you to carry out your own virus checks on any attachment to > this message. We cannot accept any liability for any loss or damage resulting > from any software viruses. If you receive this email in error, please > telephone our postmaster on +44 20 7550 8500 or email > postmas...@cityindex.co.uk and delete all copies on your system. > > City Index Limited is authorised and regulated by the Financial Conduct > Authority. FCA Register Number: 113942. Registered Office: Park House, 16 > Finsbury Circus, London, EC2M 7EB. Registered in England and Wales, number: > 1761813. ------------------------------------------------------------------------------ Meet PCI DSS 3.0 Compliance Requirements with EventLog Analyzer Achieve PCI DSS 3.0 Compliant Status with Out-of-the-box PCI DSS Reports Are you Audit-Ready for PCI DSS 3.0 Compliance? Download White paper Comply to PCI DSS 3.0 Requirement 10 and 11.5 with EventLog Analyzer http://p.sf.net/sfu/Zoho _______________________________________________ nxlog-ce-users mailing list nxlog-ce-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/nxlog-ce-users
