Csv_parser failing

Graylog Add-ons
1

Is cvs_parser really a module? I would have thought it is a function withing the module im_file ---- I am really new to nxlog but have it importing logs from other sources that are not cvs based - I have RTFM so obviously I’m missing something fundamental - any clues or point of references would be kindly appreciated.

Thanks!

Version: nxlog-ce-3.2.2329

LOGFILE:

C:\Program Files\nxlog\data>type nxlog.log
2024-03-25 15:15:51 ERROR Couldn’t parse Exec block at C:\Program Files\nxlog\conf\nxlog.d\protocol.conf:21; couldn’t parse statement at line 25, character 27 in C:\Program Files\nxlog\conf\nxlog.d\protocol.conf; module csv_parser not found
2024-03-25 15:15:51 ERROR Couldn’t parse Exec block at C:\Program Files\nxlog\conf\nxlog.d\protocol.conf:34; couldn’t parse statement at line 38, character 26 in C:\Program Files\nxlog\conf\nxlog.d\protocol.conf; module csv_parser not found
2024-03-25 15:15:51 WARNING not starting unused module smtp_receive
2024-03-25 15:15:51 WARNING not starting unused module smtp_send
2024-03-25 15:15:51 INFO nxlog-ce-3.2.2329 started

CONFIG: protocol.conf - in nxlog.d

define BASEDIR C:\Program Files\Microsoft\Exchange Server\V15

#Software: Microsoft Exchange Server
#Version: 15.0.0.0
#Log-type: SMTP Receive Protocol Log
#Date: 2024-03-25T19:00:26.686Z
#Fields: date-time,connector-id,session-id,sequence-number,local-endpoint,remote-endpoint,event,data,context

MJ number of fields matches count

Module xm_csv Fields date-time, connector-id, session-id, sequence-number, \ local-endpoint, remote-endpoint, event, data, context Module im_file File '%BASEDIR%\TransportRoles\Logs\Hub\ProtocolLog\SmtpReceive\RECV*.LOG' if $raw_event =~ /^(\xEF\xBB\xBF)?(date-time,|#)/ drop(); else { csv_parser->parse_csv(); $EventTime = parsedate(${date-time}); } Module im_file File '%BASEDIR%\TransportRoles\Logs\Hub\ProtocolLog\SmtpSend\SEND*.LOG' if $raw_event =~ /^(\xEF\xBB\xBF)?(date-time,|#)/ drop(); else { csv_parser->parse_csv(); $EventTime = parsedate(${date-time}); }

Inputs should work in my mind with no output or route statements - added this only made them not log as then indicated issue with input smtp_send and smtp_recevie

Module om_udp Host 10.10.0.9 Port 3514 OutputType GELF_UDP

<Route 50>
Path smtp_send => graylog_udp

<Route 51>
Path smtp_receive => graylog_udp

2

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.