Mark (im_mark)

Mark messages are used to indicate periodic activity and ensure NXLog Agent is running when log sources are not sending logs.

By default, if no module-specific directives are set, a log message will be generated every 30 minutes containing -- MARK --.

The $raw_event field is not generated in syslog format. If mark messages are required in syslog format, they must be explicitly converted with the to_syslog_bsd() procedure.

The functionality of the im_mark module can be also achieved using the Schedule block with a log_info("--MARK--") Exec statement, which would insert the messages via the im_internal module into a route. Using a single module for this task can simplify configuration.

Configuration

The im_mark module accepts the following directives in addition to the common module directives.

Optional directives

Mark

This optional directive sets the string for the mark message. The default is -- MARK --.

MarkInterval

This optional directive sets the interval for mark messages, in minutes. The default is 30 minutes.

Fields

The following fields are used by im_mark.

$raw_event (type: string): A list of event fields in key-value pairs.

$EventTime (type: datetime): The current time.

$Message (type: string): The same value as $raw_event.

$ProcessID (type: integer): The process ID of the NXLog Agent process.

$Severity (type: string): The severity name: INFO.

$SeverityValue (type: integer): The INFO severity level value: 2.

$SourceName (type: string): Set to nxlog.

Examples

Example 1. Using the im_mark module

Here, NXLog Agent will write the specified string to a file every minute.

nxlog.conf

<Input mark>
    Module          im_mark
    MarkInterval    1
    Mark            -=| MARK |=-
</Input>

<Output file>
    Module          om_file
    File            "tmp/output"
</Output>

<Route mark_to_file>
    Path            mark => file
</Route>