Nagios Support Forum

Code: Select all

## See the nxlog reference manual at 
## http://nxlog.org/nxlog-docs/en/nxlog-reference-manual.html
 
## Please set the ROOT to the folder your nxlog was installed into,
## otherwise it will not start.
#define ROOT C:\Program Files\nxlog
define ROOT C:\Program Files (x86)\nxlog
define CERT %ROOT%\cert
 
Moduledir %ROOT%\modules
#CacheDir %ROOT%\data
#Pidfile %ROOT%\data\nxlog.pid
#SpoolDir %ROOT%\data
#LogFile %ROOT%\data\nxlog.log

CacheDir e:\nxlog\data
Pidfile g:\nxlog\data\nxlog.pid
SpoolDir e:\nxlog\data
LogFile g:\nxlog\nxlog.log
 
# Include fileop while debugging, also enable in the output module below
<Extension fileop>
	Module xm_fileop
</Extension>
 
<Extension json>
	Module      xm_json
</Extension>
 
<Extension syslog>
	Module xm_syslog
</Extension>
 
<Input internal>
	Module im_internal
</Input>
 
# Watch your own files
<Input nxlog>
	Module   im_file
	#File     '%ROOT%\data\nxlog.log'
	File     'g:\nxlog\nxlog.log'
	SavePos  TRUE
	Exec     $Message = $raw_event;
</Input>


<Input tuxedo-ulog>
	Module im_file
	File "g:\\amest\\logfile\\ULOG\\ULOG." + strftime(now(), "%m%d%y")
	SavePos TRUE

	# build the filename
	EXEC if (file_name() =~/(\d\d)(\d\d)(\d\d)$/) \
	{\
		$logTime ="20"+$3 + "-" + $1 + "-" +$2; \
		if ($raw_event =~/^(\d\d)(\d\d)(\d\d)/ )\
		{\
			$logTime = $logTime + " " + $1+":" + $2 + ":" + $3;\
		}\
	};
	
	#frop trace lines
	Exec if ($raw_event =~/.*TRACE\:.*/) drop();

	Exec $Component = 'Tuxedo';
	Exec $LogFile = 'ULOG';
</Input>
 
<Input tuxedo-useractionlog>
	Module im_file
	File "g:\\amest\\logfile\\useractionlog\\useractions-" + strftime(now(), "%Y%m%d") + ".log"
	SavePos TRUE

	Exec $Component = 'Tuxedo';
	Exec $LogFile = 'useractionlog';
</Input>

 <Input tuxedo_tmadmin_usercount>
	Module im_file
	File "g:/Input_for_Kibana/prod/Tuxedo/tmadmin_usercount-" + strftime(now(), "%Y%m%d") + ".log"
	SavePos TRUE

	Exec $Component = 'Tuxedo';
	Exec $LogFile = 'tmadmin_usercount';
</Input> 
 
<Input rdautoorders>
	Module im_file
	File "g:/amest/logfile/rdAutoOrders/rdautoorders-" + strftime(now(), "%Y%m%d") + ".log"
	SavePos TRUE

	Exec $Component = 'Tuxedo';
	Exec $LogFile = 'rdautoorders';
</Input>
  
<Input tapdispatcher>
	Module im_file
	File "g:/amest/logfile/tapDispatcher/tap-"+ strftime(now(), "%Y%m%d") + ".log"
	SavePos true

	Exec $Component = 'Tuxedo';
	Exec $LogFile = 'tapdispatcher';
</Input>

<Input ttp>
	Module im_file
	File "g:/amest/logfile/ttp/ttp-"+ strftime(now(), "%Y%m%d") + ".log"
	SavePos true
	
	Exec $Component = 'Tuxedo';
	Exec $LogFile = 'ttp';
</Input>

<Input topbeat>
	Module im_file
	File "g:/Input_For_Kibana/topbeat/topbeat.log"
	SavePos true

	Exec $Component = 'SystemStats';
	Exec $LogFile = 'topbeat';
	Exec $osType = 'win';
</Input>

<Input smsc-http-recv>
	Module im_file
	File "g:/amest/logfile/smsc-http-recv/smsc-http-recv-"+ strftime(now(), "%Y%m%d") + ".log"
	SavePos true

	Exec $Component = 'Tuxedo';
	Exec $LogFile = 'smsc-http-recv';
</Input>

<Input smsc-http-send>
	Module im_file
	File "g:/amest/logfile/smsc-http-send/smsc-http-send-"+ strftime(now(), "%Y%m%d") + ".log"
	SavePos true
	
	Exec $Component = 'Tuxedo';
	Exec $LogFile = 'smsc-http-send';
</Input>
 
<Output out>
	# connection stuff
	Module om_tcp
	Host xxx.xxx.xxxx.xxxx
	Port xxxx
	
	# server stuff like name, stage, etc.
	Exec $HostName = 'xxx';
	Exec $Stage = 'Production';
	Exec $ServerType = 'yyyy';
	
	# write copy the raw event to message field
	Exec $message = $raw_event;
	
	# convert raw event including all fields to json
	Exec $raw_event = to_json();
	
	# Uncomment for debug output
	#Exec file_write('g:\nxlog\nxlog_debug_output.log', $raw_event + "\n");
</Output>
 
<Route 1>
	Path internal, tuxedo-ulog, tuxedo-useractionlog, tuxedo_tmadmin_usercount, topbeat, smsc-http-recv,smsc-http-send, rdautoorders, tapdispatcher  => out
</Route>

Code: Select all

top - 10:37:57 up 4 days, 23:25,  3 users,  load average: 1.40, 0.90, 0.71
Tasks: 255 total,   1 running, 254 sleeping,   0 stopped,   0 zombie
Cpu(s):  7.4%us,  0.5%sy, 14.6%ni, 77.4%id,  0.0%wa,  0.0%hi,  0.0%si,  0.0%st
Mem:  20462820k total, 19616600k used,   846220k free,   263096k buffers
Swap:  8388320k total,    56356k used,  8331964k free,  6540136k cached

  PID USER      PR  NI  VIRT  RES  SHR S %CPU %MEM    TIME+  COMMAND
23398 nagios    39  19 5298m 575m  14m S 195.5  2.9   8:29.53 java
61938 nagios    20   0 25.5g  10g 242m S 91.4 54.5   1538:17 java

Code: Select all

input
{
        tcp
        {
                type => 'import_json'
                tags => 'import_json'
                port => 5000
                codec => json
        }

}
filter {
    metrics {
        meter => "LogFile"
        add_tag => "metric"
        flush_interval => 10
    }
}
output {
    if "metric" in [tags] {
        stdout {
            #codec => line {
            #    format => "1m rate: %{LogFile.rate_1m} ( %{LogFile.count} )"
            #}
            codec => "rubydebug"
        }
    }
}
output
{
        null{}
}

Code: Select all

if ([LogFile] == 'ttp' or [type] == 'ttp')
	{
		# drop if it is a comment line
		if [message] =~ /^#.*/
		{
			drop
			{
			}
		}
		else
		{
		
			# parse the message
			grok
			{
				match => ['message','^(?<msisdn>\+\d+)\s*(-)?\s+0x(?<ttpSeqIdHex>[\d\w]{4})\s*\[.*\]\s*\w+\s*(?<logTime>\d{2}\.\d{2}\.\d{4} \d{2}\:\d{2}\:\d{2})\s*(?<sidHex>[\d\w]+)\s*TTP DATA\:(?<payload>(?<ttpProtocolVersionHex>[\d\w]{2}) [\w\d]{2} (?<ttpLengthHex>[\w\d]{2} [\w\d]{2}).*) \(.*']
			}
			# convert hex to integer
			ruby
			{
				code => 
				"
					#convert ttplength
					hexString = event['ttpLengthHex']
					number = hexString[0..1] +  hexString[3..4]
					event['ttpPacketLength'] = number.hex
					
					# convert seq id
					event['ttpSeqIdInt'] = event['ttpSeqIdHex'].to_s.hex
				
					# convert protocol version
					event['ttpProtocolVersionInt'] = event['ttpProtocolVersionHex'].to_s.hex
            
					# convert SID
					event['sidInt'] = event['sidHex'].to_s.hex
					event['sidHex'] = '0x' + event['sidHex'].to_s
					
				"
			}
			
			# check for sid = 0x82 (check as integer because it should be faster)
			if [sidInt] == 130
			{
				# parse payload details (tap protocol for tbm2 only)
				
				if [payload] =~ /.*02 07 02 .. .. .. .. 28 00 00.*/
				{
					# is position message
					mutate { add_field => { 'messageType' => 'Position' } }
				}
				else
				{
					# is maintenance data
					if [payload] =~ /.*02 07 02 .. .. .. .. 28 00 20.*/
					{
						mutate { add_field => { 'messageType' => 'Maintenance' } }
					}
					else
					{	
						# is driving time message
						if [payload] =~ /.*02 07 02 .. .. .. .. 28 00 40.*/
						{
							mutate { add_field => { 'messageType' => 'DrivingTime' } }
							# process details of driving time messages
							grok
							{
								match => ['payload','.*02 07 02 .. .. .. .. 28 00 40 (?<dtcoDetails>..).*']
							}
							# parse the details of dtco message
							if [dtcoDetails] == '01'
							{
								mutate { add_field => { 'messageTypeDetails' => 'tco_data_cyclic' } }
							}
							else
							{
								if [dtcoDetails] == '02'
								{
									mutate { add_field => { 'messageTypeDetails' => 'tco_data_on_card_in' } }
								}
								else
								{
									if [dtcoDetails] == '03'
									{
										mutate { add_field => { 'messageTypeDetails' => 'tco_data_on_card_out' } }
									}
									else
									{
										if [dtcoDetails] == '04'
										{
											mutate { add_field => { 'messageTypeDetails' => 'tco_data_on_task_change' } }
										}
										else
										{
											if [dtcoDetails] == '0d'
											{
												mutate { add_field => { 'messageTypeDetails' => 'tco_data_on_ignition_off' } }
											}
											else
											{
												if [dtcoDetails] == '0e'
												{
													mutate { add_field => { 'messageTypeDetails' => 'tco_data_on_warn_driver_1' } }
												}
												else
												{
													if [dtcoDetails] == '12'
													{
														mutate { add_field => { 'messageTypeDetails' => 'tco_data_on_change_followUpTime_1_to_2' } }
													}
													else
													{
														if [dtcoDetails] == '13'
														{
															mutate { add_field => { 'messageTypeDetails' => 'tco_data_on_motor_on' } }
														}
													}
												}
											}
										}
									}
								}
							}
							
						}
						else
						{
							if [payload] =~ /.*02 07 02 .. .. .. .. 28 00 50.*/
							{
								mutate { add_field => { 'messageType' => 'TourHistory' } }
							}
							else
							{
								if [payload] =~ /.*02 07 02 .. .. .. .. 28 00 60.*/
								{
									mutate { add_field => { 'messageType' => 'VOA' } }
								}
								else
								{
									if [payload] =~ /.*02 07 02 .. .. .. .. 28 00 70.*/
									{
										mutate { add_field => { 'messageType' => 'Geofencing' } }
									}
								}
							}
						}
					}
				}
			}
			
			
			# convert extracted timestamp logTime to elasticSearch's timestamp field
			date 
			{
				match => ['logTime', 'dd.MM.YYYY HH:mm:ss']
				timezone => 'UTC'
				remove_field => ['logTime']
			}
			
			
			
			# mutate part
			mutate
			{
				# delete fields no longer used
				remove_field => ['dtcoDetails']
				remove_field => ['payload']
				
			}
		}
	}

Code: Select all

grok
         {
            match => ['message','^(?<msisdn>\+\d+)\s*(-)?\s+0x(?<ttpSeqIdHex>[\d\w]{4})\s*\[.*\]\s*\w+\s*(?<logTime>\d{2}\.\d{2}\.\d{4} \d{2}\:\d{2}\:\d{2})\s*(?<sidHex>[\d\w]+)\s*TTP DATA\:(?<payload>(?<ttpProtocolVersionHex>[\d\w]{2}) [\w\d]{2} (?<ttpLengthHex>[\w\d]{2} [\w\d]{2}).*) \(.*']
         }