The filename, directory name, or volume label syntax

[dlukinski]

Hello LOG Support

Getting this error when trying to ship logs from Windows servers:

Code: Select all

{"EventTime":"2016-12-16 19:37:18","Hostname":"fihp-tcdis11","SeverityValue":4,"Severity":"ERROR","SourceName":"nxlog-ce","ProcessID":7364,"ErrorCode":720123,"EventReceivedTime":"2016-12-16 19:37:18","SourceModuleName":"internal","SourceModuleType":"im_internal","message":"apr_stat failed on file C:\\Siemens\\Dispatcher11.2\\Logs\\Dispatcher\\process\\*.log\r\nThe filename, directory name, or volume label syntax is incorrect.  "}

nxlog.conf file attached.

- works in similar cases (other path on the same type of windows server, only path is different)
- could this be permission issue (what kind of permissions would be required ?)

Thank you

[mcapra]

This has more to do with nxlog than anything related to Nagios Log Server.

Here's the source behind im_file where that exception is being thrown:

Code: Select all

		
	rv = apr_stat(&finfo, fname,
		      APR_FINFO_INODE | APR_FINFO_MTIME | APR_FINFO_SIZE, pool);
	if ( rv == APR_SUCCESS )
	{
	}
	else if ( rv == APR_INCOMPLETE )
	{ // partial results returned. we check the valid bitmask
	}
	else
	{
	    throw(rv, "apr_stat failed on file %s", fname);
	}

The implication being that nxlog was unable to stat the file. So I think your initial hunch that this is related to permission is correct, though it could also be a file contained in that path contains some special characters in it's name that is tripping up nxlog.

It's also interesting that im_internal is the module being leveraged here since im_internal doesn't even appear to use apr_stat anywhere.

[dlukinski]

This has more to do with nxlog than anything related to Nagios Log Server.

Here's the source behind im_file where that exception is being thrown:

Code: Select all

		
	rv = apr_stat(&finfo, fname,
		      APR_FINFO_INODE | APR_FINFO_MTIME | APR_FINFO_SIZE, pool);
	if ( rv == APR_SUCCESS )
	{
	}
	else if ( rv == APR_INCOMPLETE )
	{ // partial results returned. we check the valid bitmask
	}
	else
	{
	    throw(rv, "apr_stat failed on file %s", fname);
	}

The implication being that nxlog was unable to stat the file. So I think your initial hunch that this is related to permission is correct, though it could also be a file contained in that path contains some special characters in it's name that is tripping up nxlog.

It's also interesting that im_internal is the module being leveraged here since im_internal doesn't even appear to use apr_stat anywhere.

Here is the filename - Module_8dbfecc9_1d597998_fihp-tcdis11.log

Should we change *.log to *.* ? (only log file in there anyways)
- changed for 1 server and now have this message instead:

Code: Select all

	{"EventTime":"2016-12-16 21:14:10","Hostname":"fihp-tcdis11","SeverityValue":2,"Severity":"INFO","SourceName":"nxlog-ce","ProcessID":5348,"EventReceivedTime":"2016-12-16 21:14:10","SourceModuleName":"internal","SourceModuleType":"im_internal","message":"connecting to logging.konecranes.com:4445"}

[mcapra]

I'm not sure on the permissions, but one thing I notice is that the backslashes are not escaped which can sometimes trip up the wildcard inclusions in im_file. See if altering the windowsfile input to use the following improves things:

Code: Select all

<Input windowsfile>
    Module   im_file
    File     'C:\\Siemens\\Dispatcher11.2\\Logs\\Dispatcher\\process\\*.log'
    SavePos  TRUE
#    ReadFromLast FALSE
    Exec     $Message = $raw_event;
</Input>

[dlukinski]

I'm not sure on the permissions, but one thing I notice is that the backslashes are not escaped which can sometimes trip up the wildcard inclusions in im_file. See if altering the windowsfile input to use the following improves things:

Code: Select all

<Input windowsfile>
    Module   im_file
    File     'C:\\Siemens\\Dispatcher11.2\\Logs\\Dispatcher\\process\\*.log'
    SavePos  TRUE
#    ReadFromLast FALSE
    Exec     $Message = $raw_event;
</Input>

Let me try this one too

[mcapra]

Did escaping the backslashes produce any changes?

[dlukinski]

Did escaping the backslashes produce any changes?

This worked. Please close the thread.

Thank you