0

I'm using nxlog to watch two vCenter log files on a Windows Server 2008 system and I have a very simple config to ship messages to Logstash. Nxlog began failing yesterday after a file was rotated. Here's my config:

<Extension syslog>
    Module      xm_syslog
</Extension>

<Input in1>
    Module      im_file
    File        "C:\ProgramData\VMware\VMware VirtualCenter\Logs\vpxd-[0-5][0-9].log"
    SavePos     TRUE
</Input>

<Input in2>
    Module      im_file
    File        "C:\ProgramData\VMware\VMware VirtualCenter\Logs\vpxd-alert-[0-5][0-9].log"
    SavePos     TRUE
</Input>

<Processor buffer1>
    Module  pm_buffer
    MaxSize 1024
    Type    Mem
    WarnLimit   512
</Processor>

<Processor buffer2>
    Module  pm_buffer
    MaxSize 1024
    Type    Mem
    WarnLimit   512
</Processor>

<Output out1>
    Module      om_udp
    Host        <ip>
    Port        514
</Output>

<Output out2>
    Module      om_udp
    Host        <ip>
    Port        514
</Output>

<Route 1>
    Path        in1 => buffer1 => out1
</Route>

<Route 2>
    Path        in2 => buffer2 => out2
</Route>

vCenter log rotation is a bit odd so I'm thinking that it's at least partially causing this problem. You can see from above the filename I'm watching. This file is created as vpxd-01.log and increments up from there. The files are rotated when they hit 50MB and old logs get compressed after two new files are created, e.g. vpxd-03 is created and vpxd-01 gets compressed.

But yesterday the first file that nxlog had started watching (since being installed last week) was rotated, causing this error:

2013-12-28 19:41:08 WARNING input file does not exist: C:\ProgramData\VMware\VMware VirtualCenter\Logs\vpxd-47.log

It repeats 12 times across the next 24 hours and then nxlog failed entirely until I restarted the service yesterday morning.

Hopefully my explanation makes sense. I ended up losing about six hours of logs so I want to make sure this doesn't happen again. Does anybody have any solution or suggestions?

2
  • You can try to change your configuration from a specific log file to the directory where the logs are created. – user204583 Jan 7 '14 at 8:56
  • I'm only wanting to log two specific vCenter log files: vpxd-xx.log and vpxd-alert-xx.log. The vCenter log directory contains quite a few other logs that I don't care about so that prevents me from setting the directory instead of the specific files in the nxlog config. – HarryTruman Jan 9 '14 at 14:59
0

Try using this input instead instead of hard defining [0-5][0-9]:

<Input in2>
    Module      im_file
    File        "C:\ProgramData\VMware\VMware VirtualCenter\Logs\vpxd-*.log"
    SavePos     TRUE
</Input>
1
  • There are other files in that log directory that are named similarly. For instance, vpxd-alerts and vpxd-profiler, with each also having digits after the filename. – HarryTruman Feb 5 '14 at 20:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.