Mark (im_mark)
Mark messages are used to indicate periodic activity and ensure NXLog Agent is running when log sources are not sending logs.
By default, if no module-specific directives are set, a log message will be generated every 30 minutes containing -- MARK --
.
The $raw_event field is not generated in syslog format. If mark messages are required in syslog format, they must be explicitly converted with the to_syslog_bsd() procedure. |
The functionality of the im_mark module can be also achieved using the Schedule block with a log_info("--MARK--") Exec statement, which would insert the messages via the im_internal module into a route. Using a single module for this task can simplify configuration. |
Configuration
The im_mark module accepts the following directives in addition to the common module directives.
Fields
The following fields are used by im_mark.
$raw_event
(type: string)-
A list of event fields in key-value pairs.
$EventTime
(type: datetime)-
The current time.
$Message
(type: string)-
The same value as $raw_event.
$ProcessID
(type: integer)-
The process ID of the NXLog Agent process.
$Severity
(type: string)-
The severity name:
INFO
.
$SeverityValue
(type: integer)-
The INFO severity level value:
2
.
$SourceName
(type: string)-
Set to
nxlog
.
Examples
Here, NXLog Agent will write the specified string to file every minute.
<Input mark>
Module im_mark
MarkInterval 1
Mark -=| MARK |=-
</Input>
<Output file>
Module om_file
File "tmp/output"
</Output>
<Route mark_to_file>
Path mark => file
</Route>