Page 1 of 1
The filename, directory name, or volume label syntax
Posted: Fri Dec 16, 2016 12:44 pm
by dlukinski
Hello LOG Support
Getting this error when trying to ship logs from Windows servers:
Code: Select all
{"EventTime":"2016-12-16 19:37:18","Hostname":"fihp-tcdis11","SeverityValue":4,"Severity":"ERROR","SourceName":"nxlog-ce","ProcessID":7364,"ErrorCode":720123,"EventReceivedTime":"2016-12-16 19:37:18","SourceModuleName":"internal","SourceModuleType":"im_internal","message":"apr_stat failed on file C:\\Siemens\\Dispatcher11.2\\Logs\\Dispatcher\\process\\*.log\r\nThe filename, directory name, or volume label syntax is incorrect. "}
nxlog.conf file attached.
- works in similar cases (other path on the same type of windows server, only path is different)
- could this be permission issue (what kind of permissions would be required ?)
Thank you
Re: The filename, directory name, or volume label syntax
Posted: Fri Dec 16, 2016 1:11 pm
by mcapra
This has more to do with nxlog than anything related to Nagios Log Server.
Here's the source behind im_file where that exception is being thrown:
Code: Select all
rv = apr_stat(&finfo, fname,
APR_FINFO_INODE | APR_FINFO_MTIME | APR_FINFO_SIZE, pool);
if ( rv == APR_SUCCESS )
{
}
else if ( rv == APR_INCOMPLETE )
{ // partial results returned. we check the valid bitmask
}
else
{
throw(rv, "apr_stat failed on file %s", fname);
}
The implication being that nxlog was unable to stat the file. So I think your initial hunch that this is related to permission is correct, though it could also be a file contained in that path contains some special characters in it's name that is tripping up nxlog.
It's also interesting that
im_internal is the module being leveraged here since
im_internal doesn't even appear to use apr_stat anywhere.
Re: The filename, directory name, or volume label syntax
Posted: Fri Dec 16, 2016 1:39 pm
by dlukinski
mcapra wrote:This has more to do with nxlog than anything related to Nagios Log Server.
Here's the source behind im_file where that exception is being thrown:
Code: Select all
rv = apr_stat(&finfo, fname,
APR_FINFO_INODE | APR_FINFO_MTIME | APR_FINFO_SIZE, pool);
if ( rv == APR_SUCCESS )
{
}
else if ( rv == APR_INCOMPLETE )
{ // partial results returned. we check the valid bitmask
}
else
{
throw(rv, "apr_stat failed on file %s", fname);
}
The implication being that nxlog was unable to stat the file. So I think your initial hunch that this is related to permission is correct, though it could also be a file contained in that path contains some special characters in it's name that is tripping up nxlog.
It's also interesting that
im_internal is the module being leveraged here since
im_internal doesn't even appear to use apr_stat anywhere.
Here is the filename - Module_8dbfecc9_1d597998_fihp-tcdis11.log
Should we change *.log to *.* ? (only log file in there anyways)
- changed for 1 server and now have this message instead:
Code: Select all
{"EventTime":"2016-12-16 21:14:10","Hostname":"fihp-tcdis11","SeverityValue":2,"Severity":"INFO","SourceName":"nxlog-ce","ProcessID":5348,"EventReceivedTime":"2016-12-16 21:14:10","SourceModuleName":"internal","SourceModuleType":"im_internal","message":"connecting to logging.konecranes.com:4445"}
Re: The filename, directory name, or volume label syntax
Posted: Fri Dec 16, 2016 3:00 pm
by mcapra
I'm not sure on the permissions, but one thing I notice is that the backslashes are not escaped which can sometimes trip up the wildcard inclusions in
im_file. See if altering the windowsfile input to use the following improves things:
Code: Select all
<Input windowsfile>
Module im_file
File 'C:\\Siemens\\Dispatcher11.2\\Logs\\Dispatcher\\process\\*.log'
SavePos TRUE
# ReadFromLast FALSE
Exec $Message = $raw_event;
</Input>
Re: The filename, directory name, or volume label syntax
Posted: Sun Dec 18, 2016 1:57 pm
by dlukinski
mcapra wrote:I'm not sure on the permissions, but one thing I notice is that the backslashes are not escaped which can sometimes trip up the wildcard inclusions in
im_file. See if altering the windowsfile input to use the following improves things:
Code: Select all
<Input windowsfile>
Module im_file
File 'C:\\Siemens\\Dispatcher11.2\\Logs\\Dispatcher\\process\\*.log'
SavePos TRUE
# ReadFromLast FALSE
Exec $Message = $raw_event;
</Input>
Let me try this one too
Re: The filename, directory name, or volume label syntax
Posted: Mon Dec 19, 2016 10:32 am
by mcapra
Did escaping the backslashes produce any changes?
Re: The filename, directory name, or volume label syntax
Posted: Wed Mar 08, 2017 8:08 am
by dlukinski
mcapra wrote:Did escaping the backslashes produce any changes?
This worked. Please close the thread.
Thank you