Hi, Currently such files cannot be read by NXLog. A special input reader needs to be developed that treats NULL byte(s) as the record terminator.
Regards, Botond On Wed, 18 Mar 2015 13:13:45 +0000 David Laing <david.la...@cityindex.com> wrote: > Hi, > > I'm trying to ship a MetaTrader4 server log file on Windows, using nxlog 2.8 > and an im_file directive. > > The MetaTrader4 log file is weird, since it seems to be terminated with a > bunch of null bytes. > > Below is how BareTailPro shows the file. > > [cid:image001.png@01D0617C.6731F2B0] > > Nxlog will ship the data when the file is first opened, but then seems unable > to detect new data as it is written to the file. > > It looks like the length of the log files remains constant, when new data is > written it goes before the NULL bytes and the number of NULL bytes at the end > of the file are adjusted to keep the log file the same size. > > [cid:image002.png@01D0617C.6731F2B0] > > Nxlog's debug logs show the following around the time some new data is > written: > > 2015-03-18 13:05:46 DEBUG mtime of file > '\\MTLIV02\Apps\MetaTrader4Server\logs\20150318.log' changed > 2015-03-18 13:05:46 DEBUG nx_event_to_jobqueue: READ (in_file3) > 2015-03-18 13:05:46 DEBUG event added to jobqueue > 2015-03-18 13:05:46 DEBUG no events or no future events, event thread > sleeping in condwait > 2015-03-18 13:05:46 DEBUG worker 1 got signal for new job > 2015-03-18 13:05:46 DEBUG opening > \\MTLIV02\Apps\MetaTrader4Server\logs\20150318.log > 2015-03-18 13:05:46 DEBUG worker 1 got no event to process > 2015-03-18 13:05:46 DEBUG worker 1 waiting for new event > 2015-03-18 13:05:46 DEBUG file > \\MTLIV02\Apps\MetaTrader4Server\logs\20150318.log opened > 2015-03-18 13:05:46 DEBUG non-active modification on > \\MTLIV02\Apps\MetaTrader4Server\logs\20150318.log > 2015-03-18 13:05:46 DEBUG nx_event_to_jobqueue: READ (in_file3) > 2015-03-18 13:05:46 DEBUG event added to jobqueue > 2015-03-18 13:05:46 DEBUG worker 1 got signal for new job > 2015-03-18 13:05:46 DEBUG worker 1 got no event to process > 2015-03-18 13:05:46 DEBUG worker 0 processing event 0x20bdea8 > 2015-03-18 13:05:46 DEBUG new event in event_thread [in_file3:MODULE_SPECIFIC] > 2015-03-18 13:05:46 DEBUG PROCESS_EVENT: READ (in_file3) > 2015-03-18 13:05:46 DEBUG future event, event thread sleeping 9999000ms in > cond_timedwait > 2015-03-18 13:05:46 DEBUG Module in_file3 got EOF from > \\MTLIV02\Apps\MetaTrader4Server\logs\20150318.log > 2015-03-18 13:05:46 DEBUG worker 1 waiting for new event > 2015-03-18 13:05:46 DEBUG closing idle file > \\MTLIV02\Apps\MetaTrader4Server\logs\20150318.log (CloseWhenIdle is enabled) > 2015-03-18 13:05:46 DEBUG file > \\MTLIV02\Apps\MetaTrader4Server\logs\20150318.log closed > > If I understand the logs correctly, nxlog is detecting that the files > modification time changed, but it can't find any new data since it doesn't > know to look for it before the NULL bytes. > > Is there any way to instruct nxlog to ignore the NULL bytes at the end of the > file? > > Thanks! > > :D<br /> > > This email is intended only for the use of the individual or entity to which > it is addressed and may contain information that is confidential, subject to > copyright or which constitutes a trade secret. You should not copy it for any > purpose or disclose its contents to any person. City Index Ltd has taken > reasonable precautions to minimise the risk of transmitting software viruses > but we advise you to carry out your own virus checks on any attachment to > this message. We cannot accept any liability for any loss or damage resulting > from any software viruses. If you receive this email in error, please > telephone our postmaster on +44 20 7550 8500 or email > postmas...@cityindex.co.uk and delete all copies on your system. > > City Index Limited is authorised and regulated by the Financial Conduct > Authority. FCA Register Number: 113942. Registered Office: Park House, 16 > Finsbury Circus, London, EC2M 7EB. Registered in England and Wales, number: > 1761813. > > ------------------------------------------------------------------------------ Dive into the World of Parallel Programming The Go Parallel Website, sponsored by Intel and developed in partnership with Slashdot Media, is your hub for all things parallel software development, from weekly thought leadership blogs to news, videos, case studies, tutorials and more. Take a look and join the conversation now. http://goparallel.sourceforge.net/ _______________________________________________ nxlog-ce-users mailing list nxlog-ce-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/nxlog-ce-users
