# Problems with NXLog with sidecar 1.0.1 on 32bit Windows

**URL:** <https://community.graylog.org/t/problems-with-nxlog-with-sidecar-1-0-1-on-32bit-windows/10140>\
**Category:** Graylog Add-ons\
**Tags:** sidecar, nxlog, filebeat-windows, winlogbeat, nodatanx\
**Created:** [April 25, 2019, 10:32pm UTC](https://community.graylog.org/t/problems-with-nxlog-with-sidecar-1-0-1-on-32bit-windows/10140 "2019-04-25T22:32:08Z")\
**Posts on this page:** 18\
**Page:** 1

<div class="post-metadata">

**Author:** ![lschroth](https://avatars.discourse-cdn.com/v4/letter/l/858c86/32.png) [@lschroth](https://community.graylog.org/u/lschroth)\
**Post date:** [April 25, 2019, 10:32pm UTC](https://community.graylog.org/t/problems-with-nxlog-with-sidecar-1-0-1-on-32bit-windows/10140/1 "2019-04-25T22:32:08Z")

</div>

I’m having a problem with sidecar 1.0.1 and a windows 32bit machine. NXLog is installed in the c:\program files\nxlog but sidecar keeps looking for it in the c:\program files (x86) directory. When I change the patch to be c:\program files\nxlog, it returns the following error:  
" could not execute c:\program files\nxlog\nxlog.exe, binary path not in the collector\_binaries\_whitelist config option"

below is my Collector Binaries Whitelist.

Default:  
collector\_binaries\_whitelist:

- “C:\Program Files\Graylog\sidecar\filebeat.exe”
- “C:\Program Files\Graylog\sidecar\winlogbeat.exe”
- “C:\Program Files\Filebeat\filebeat.exe”
- “C:\Program Files\Packetbeat\packetbeat.exe”
- “C:\Program Files\Metricbeat\metricbeat.exe”
- “C:\Program Files\Heartbeat\heartbeat.exe”
- “C:\Program Files\Auditbeat\auditbeat.exe”
- “C:\Program Files\nxlog\nxlog.exe”

(bullet points are actually “-”)

---

<div class="post-metadata">

**Author:** ![tmacgbay](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/tmacgbay/32/3878_2.png) [@tmacgbay](https://community.graylog.org/u/tmacgbay)\
**Post date:** [April 26, 2019, 2:13pm UTC](https://community.graylog.org/t/problems-with-nxlog-with-sidecar-1-0-1-on-32bit-windows/10140/2 "2019-04-26T14:13:19Z")

</div>

I don’t use nxlog but taking a random guess… you may need to \ your \ like this example…

```
collector_binaries_whitelist:
  - "/usr/lib/graylog-sidecar/filebeat"
  - "/usr/bin/filebeat"
  - "/usr/bin/packetbeat"
  - "/usr/bin/nxlog"
  - "C:\\Program Files\\Sysmon\\Sysmon64.exe"

```

Another complete guess to experiment with would be single quotes rather than double.

---

<div class="post-metadata">

**Author:** ![lschroth](https://avatars.discourse-cdn.com/v4/letter/l/858c86/32.png) [@lschroth](https://community.graylog.org/u/lschroth)\
**Post date:** [April 26, 2019, 2:45pm UTC](https://community.graylog.org/t/problems-with-nxlog-with-sidecar-1-0-1-on-32bit-windows/10140/3 "2019-04-26T14:45:06Z")

</div>

Thanks for the suggestion. I typed in my Collectors\_binaries\_whitelist incorrectly. It actually has the following:

- “C:\Program Files\Graylog\sidecar\filebeat.exe”
- “C:\Program Files\Graylog\sidecar\winlogbeat.exe”
- “C:\Program Files\Filebeat\filebeat.exe”
- “C:\Program Files\Packetbeat\packetbeat.exe”
- “C:\Program Files\Metricbeat\metricbeat.exe”
- “C:\Program Files\Heartbeat\heartbeat.exe”
- “C:\Program Files\Auditbeat\auditbeat.exe”
- “C:\Program Files\nxlog\nxlog.exe”

(bullet points are actually “-”)

The ones above the nxlog line are from the examples, but it does not seem to take…

---

<div class="post-metadata">

**Author:** ![lschroth](https://avatars.discourse-cdn.com/v4/letter/l/858c86/32.png) [@lschroth](https://community.graylog.org/u/lschroth)\
**Post date:** [April 26, 2019, 2:46pm UTC](https://community.graylog.org/t/problems-with-nxlog-with-sidecar-1-0-1-on-32bit-windows/10140/4 "2019-04-26T14:46:00Z")

</div>

Sorry, each line has double '\", but the editor is takening them out…

---

<div class="post-metadata">

**Author:** ![tmacgbay](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/tmacgbay/32/3878_2.png) [@tmacgbay](https://community.graylog.org/u/tmacgbay)\
**Post date:** [April 26, 2019, 3:40pm UTC](https://community.graylog.org/t/problems-with-nxlog-with-sidecar-1-0-1-on-32bit-windows/10140/5 "2019-04-26T15:40:28Z")

</div>

you can use the \</\> formatting button to maintain preformatted text. Did you try using single rather than double quotes?

---

<div class="post-metadata">

**Author:** ![lschroth](https://avatars.discourse-cdn.com/v4/letter/l/858c86/32.png) [@lschroth](https://community.graylog.org/u/lschroth)\
**Post date:** [April 26, 2019, 10:14pm UTC](https://community.graylog.org/t/problems-with-nxlog-with-sidecar-1-0-1-on-32bit-windows/10140/6 "2019-04-26T22:14:44Z")

</div>

Yes, tried it with the `\\` and `\` and with double quotes and single quotes. Error message is the same both ways.

---

<div class="post-metadata">

**Author:** ![tmacgbay](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/tmacgbay/32/3878_2.png) [@tmacgbay](https://community.graylog.org/u/tmacgbay)\
**Post date:** [April 28, 2019, 12:10am UTC](https://community.graylog.org/t/problems-with-nxlog-with-sidecar-1-0-1-on-32bit-windows/10140/7 "2019-04-28T00:10:53Z")

</div>

Post up more surrounding information - The whole config (not just the whitelist) , any related nxlog config or log files… again, I don’t use nxlog, so it’s harder to guess from minimal information… 😉

---

<div class="post-metadata">

**Author:** ![lschroth](https://avatars.discourse-cdn.com/v4/letter/l/858c86/32.png) [@lschroth](https://community.graylog.org/u/lschroth)\
**Post date:** [April 29, 2019, 12:21am UTC](https://community.graylog.org/t/problems-with-nxlog-with-sidecar-1-0-1-on-32bit-windows/10140/8 "2019-04-29T00:21:51Z")

</div>

Here is the whole sidecar.yml

```
# The URL to the Graylog server API.
# Default: "http://127.0.0.1:9000/api/"
server_url: "http://172.16.x.xx:9000/api"

# The API token to use to authenticate against the Graylog server API.
# Default: none
server_api_token: "xxxxxxxxxxxxxxxxxxxxxx"

# The node ID of the sidecar. This can be a path to a file or an ID string.
# If set to a file and the file doesn't exist, the sidecar will generate an
# unique ID and writes it to the configured path.
#
# Example file path: "file:C:\\Program Files\\Graylog\\sidecar\\node-id"
# Example ID string: "6033137e-d56b-47fc-9762-cd699c11a5a9"
#
# ATTENTION: Every sidecar instance needs a unique ID!
#
# Default: "file:C:\\Program Files\\Graylog\\sidecar\\node-id"
node_id: "file:C:\\Program Files\\Graylog\\sidecar\\node-id"

# The node name of the sidecar. If this is empty, the sidecar will use the
# hostname of the host it is running on.
# Default: ""
node_name: "VOPvoice"

# The update interval in secods. This configures how often the sidecar will
# contact the Graylog server for keep-alive and configuration update requests.
# Default: 10
update_interval: 10

# This configures if the sidecar should skip the verification of TLS connections.
# Default: false
tls_skip_verify: false

# This enables/disables the transmission of detailed sidecar information like
# collector statues, metrics and log file lists. It can be disabled to reduce
# load on the Graylog server if needed. (disables some features in the server UI)
# Default: true
send_status: true

# A list of directories to scan for log files. The sidecar will scan each
# directory for log files and submits them to the server on each update.
#
# Example:
# list_log_files:
# - "/var/log/nginx"
# - "/opt/app/logs"
#
# Default: empty list
#list_log_files: []

# Directory where the sidecar stores internal data.
#cache_path: "C:\\Program Files\\Graylog\\sidecar\\cache"

# Directory where the sidecar stores logs for collectors and the sidecar itself.
#log_path: "C:\\Program Files\\Graylog\\sidecar\\logs"

# The maximum size of the log file before it gets rotated.
#log_rotate_max_file_size: "10MiB"

# The maximum number of old log files to retain.
#log_rotate_keep_files: 10

# Directory where the sidecar generates configurations for collectors.
#collector_configuration_directory: "C:\\Program Files\\Graylog\\sidecar\\generated"

# A list of binaries which are allowed to be executed by the Sidecar. An empty list disables the whitelist feature.
# Wildcards can be used, for a full pattern description see https://golang.org/pkg/path/filepath/#Match
# Example:
# collector_binaries_whitelist:
# "C:\\Program Files\\Graylog\\sidecar\\winlogbeat.exe"
# "C:\\Program Files\\Filebeat\\filebeat.exe"
#	"C:\\Program Files\\nxlog\\nxlog.exe"

# Example disable whitelisting:
# collector_binaries_whitelist: "c:\\Program Files\\nxlog\\nxlog.exe"
#

#Default:
Collector_binaries_whitelist:
- "c:\\Program Files\\nxlog\\nxlog.exe"
# - "C:\\Program Files\\Graylog\\sidecar\\filebeat.exe"
# - "C:\\Program Files\\Graylog\\sidecar\\winlogbeat.exe"
# - "C:\\Program Files\\Filebeat\\filebeat.exe"
# - "C:\\Program Files\\Packetbeat\\packetbeat.exe"
# - "C:\\Program Files\\Metricbeat\\metricbeat.exe"
# - "C:\\Program Files\\Heartbeat\\heartbeat.exe"
# - "C:\\Program Files\\Auditbeat\\auditbeat.exe"
# - "C:\\Program Files\\nxlog\\nxlog.exe"

```

here is the output from debug output of sidecar:

C:\Program Files\Graylog\sidecar\>graylog-sidecar.exe -debug -c “c:\Program Files  
\Graylog\sidecar\sidecar.yml”  
time=“2019-04-28T18:21:25-05:00” level=info msg=“Using node-id: xxxxxxxxxxxx”  
time=“2019-04-28T18:21:25-05:00” level=debug msg=“Creating rotated log writer (1  
0/10) for: C:\Program Files\Graylog\sidecar\logs\sidecar.log”  
time=“2019-04-28T18:21:25-05:00” level=info msg=“Starting signal distributor”  
time=“2019-04-28T18:21:35-05:00” level=info msg=“Adding process runner for: nxlo  
g\_32bit”  
time=“2019-04-28T18:21:35-05:00” level=info msg="[nxlog\_32bit] Configuration cha  
nge detected, rewriting configuration file."  
time=“2019-04-28T18:21:35-05:00” level=error msg="[nxlog\_32bit] Couldn’t execute  
collector C:\Program Files\nxlog\nxlog.exe, binary path is not included in `  
collector\_binaries\_whitelist’ config option."  
time=“2019-04-28T18:21:45-05:00” level=debug msg="[RequestBackendList] No update  
available."  
time=“2019-04-28T18:21:45-05:00” level=debug msg="[RequestConfiguration] No upda  
te available, skipping update."  
time=“2019-04-28T18:21:51-05:00” level=info msg=“Stopping signal distributor”  
time=“2019-04-28T18:21:51-05:00” level=debug msg="[signal-processor] (seq=1) han  
dling cmd: shutdown"  
time=“2019-04-28T18:21:51-05:00” level=info msg="[nxlog\_32bit] Stopping"

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [April 29, 2019, 10:01am UTC](https://community.graylog.org/t/problems-with-nxlog-with-sidecar-1-0-1-on-32bit-windows/10140/9 "2019-04-29T10:01:02Z")

</div>

you should use the `code` block around your configuration. that makes it reable.

````
  ```
  Your text here
  ```
````

---

<div class="post-metadata">

**Author:** ![tmacgbay](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/tmacgbay/32/3878_2.png) [@tmacgbay](https://community.graylog.org/u/tmacgbay)\
**Post date:** [April 29, 2019, 1:28pm UTC](https://community.graylog.org/t/problems-with-nxlog-with-sidecar-1-0-1-on-32bit-windows/10140/10 "2019-04-29T13:28:39Z")

</div>

Please edit your post and use the code block as Jan suggested. Highlight the code and click on the \</\> button above your edit. The results show on the right side panel before you post.

---

<div class="post-metadata">

**Author:** ![lschroth](https://avatars.discourse-cdn.com/v4/letter/l/858c86/32.png) [@lschroth](https://community.graylog.org/u/lschroth)\
**Post date:** [April 29, 2019, 2:07pm UTC](https://community.graylog.org/t/problems-with-nxlog-with-sidecar-1-0-1-on-32bit-windows/10140/11 "2019-04-29T14:07:06Z")

</div>

Updated the code block to be in the correct format

---

<div class="post-metadata">

**Author:** ![tmacgbay](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/tmacgbay/32/3878_2.png) [@tmacgbay](https://community.graylog.org/u/tmacgbay)\
**Post date:** [April 29, 2019, 3:37pm UTC](https://community.graylog.org/t/problems-with-nxlog-with-sidecar-1-0-1-on-32bit-windows/10140/12 "2019-04-29T15:37:09Z")

</div>

What does your **nxlog.conf** configuration look like? I defaults to install at

> C:\Program Files (x86)\nxlog\conf

but yours might be at

> C:\Program Files\nxlog\conf

More specifically is the ROOT path defined properly in there? I am not sure if sidecar is aware of the NXLOG configuration file (still in guess mode)

Are you defining the installation path specifically during install?

```auto
> msiexec /i nxlog-4.3.4308_windows_x64.msi /q INSTALLDIR="C:\program files\nxlog"

```

What other troubleshooting steps have you taken??

---

<div class="post-metadata">

**Author:** ![lschroth](https://avatars.discourse-cdn.com/v4/letter/l/858c86/32.png) [@lschroth](https://community.graylog.org/u/lschroth)\
**Post date:** [April 29, 2019, 5:56pm UTC](https://community.graylog.org/t/problems-with-nxlog-with-sidecar-1-0-1-on-32bit-windows/10140/13 "2019-04-29T17:56:51Z")

</div>

The nxlog.conf looks correct:

```
---
define ROOT C:\Program Files\nxlog

Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
LogFile %ROOT%\data\nxlog.log
LogLevel INFO

<Extension logrotate>
    Module xm_fileop
    <Schedule>
        When @daily
        Exec file_cycle('%ROOT%\data\nxlog.log', 7);
     </Schedule>
</Extension>

<Extension gelfExt>
  Module xm_gelf
  # Avoid truncation of the short_message field to 64 characters.
  ShortMessageLength 65536
</Extension>

<Input eventlog>
        Module im_msvistalog
        PollInterval 1
        SavePos True
        ReadFromLast True
        
        #Channel System
        #<QueryXML>
        # <QueryList>
        # <Query Id='1'>
        # <Select Path='Security'>*[System/Level=4]</Select>
        # </Query>
        # </QueryList>
        #</QueryXML>
</Input>

<Input file>
	Module im_file
	File 'C:\Windows\MyLogDir\\*.log'
	PollInterval 1
	SavePos	True
	ReadFromLast True
	Recursive False
	RenameCheck False
	Exec $FileName = file_name(); # Send file name with each message
</Input>

<Output gelf>
	Module om_tcp
	Host 172.16.0.87
	Port 22222
	OutputType GELF_TCP
	<Exec>
	  # These fields are needed for Graylog
	  $gl2_source_collector = 'a0227add-290d-49a8-aad3-f4f54ff29683';
	  $collector_node_id = 'VOPvoice';
	</Exec>
</Output>

<Route route-1>
  Path eventlog => gelf
</Route>
<Route route-2>
  Path file => gelf
</Route>
----

```

This is an installation on a 32 bit os. The default path for all installations on 32 bit is “c:\program files”. I have tried all different types of path variations, but nothing seems to work.

I will put in a bug to github and see what the developers come back with…

---

<div class="post-metadata">

**Author:** ![tmacgbay](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/tmacgbay/32/3878_2.png) [@tmacgbay](https://community.graylog.org/u/tmacgbay)\
**Post date:** [April 29, 2019, 6:00pm UTC](https://community.graylog.org/t/problems-with-nxlog-with-sidecar-1-0-1-on-32bit-windows/10140/14 "2019-04-29T18:00:37Z")

</div>

> [@lschroth](#):
>
> I will put in a bug to github and see what the developers come back with…

Probably best. Another thought… create a `C:\Program Files (x86)\nxlog` directory anyway and just work from it there.

---

<div class="post-metadata">

**Author:** ![lschroth](https://avatars.discourse-cdn.com/v4/letter/l/858c86/32.png) [@lschroth](https://community.graylog.org/u/lschroth)\
**Post date:** [April 30, 2019, 12:08am UTC](https://community.graylog.org/t/problems-with-nxlog-with-sidecar-1-0-1-on-32bit-windows/10140/15 "2019-04-30T00:08:14Z")

</div>

I agree, I can make it work that way.

---

<div class="post-metadata">

**Author:** ![lschroth](https://avatars.discourse-cdn.com/v4/letter/l/858c86/32.png) [@lschroth](https://community.graylog.org/u/lschroth)\
**Post date:** [May 3, 2019, 9:14pm UTC](https://community.graylog.org/t/problems-with-nxlog-with-sidecar-1-0-1-on-32bit-windows/10140/16 "2019-05-03T21:14:42Z")

</div>

Ended making it work with the addition to the sidecar.yml on the machine. The line is very case sensitive…

collector\_binaries\_whitelist: [“C:\Program Files\nxlog\nxlog.exe”]

---

<div class="post-metadata">

**Author:** ![tmacgbay](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/tmacgbay/32/3878_2.png) [@tmacgbay](https://community.graylog.org/u/tmacgbay)\
**Post date:** [May 6, 2019, 4:55pm UTC](https://community.graylog.org/t/problems-with-nxlog-with-sidecar-1-0-1-on-32bit-windows/10140/17 "2019-05-06T16:55:58Z")

</div>

Interesting! Case Sensitive and Windows rarely go together other than passwords. Thanks for following up on that!!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [May 20, 2019, 5:01pm UTC](https://community.graylog.org/t/problems-with-nxlog-with-sidecar-1-0-1-on-32bit-windows/10140/18 "2019-05-20T17:01:17Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.