NXLog Documentation

Mark (im_mark)

Mark messages are used to indicate periodic activity to assure that the logger is running when there are no log messages coming in from other sources.

To examine the supported platforms, see the list of installer packages in the Available Modules chapter.

By default, if no module-specific directives are set, a log message will be generated every 30 minutes containing -- MARK --.

The $raw_event field is not generated in syslog format. If mark messages are required in syslog format, they must be explicitly converted with the to_syslog_bsd() procedure.

The functionality of the im_mark module can be also achieved using the Schedule block with a log_info("--MARK--") Exec statement, which would insert the messages via the im_internal module into a route. Using a single module for this task can simplify configuration.

Configuration

The im_mark module accepts the following directives in addition to the common module directives.

Mark: This optional directive sets the string for the mark message. The default is -- MARK --.

MarkInterval: This optional directive sets the interval for mark messages, in minutes. The default is 30 minutes.

Fields

The following fields are used by im_mark.

$raw_event (type: string): A list of event fields in key-value pairs.

$EventTime (type: datetime): The current time.

$Message (type: string): The same value as $raw_event.

$ProcessID (type: integer): The process ID of the NXLog process.

$Severity (type: string): The severity name: INFO.

$SeverityValue (type: integer): The INFO severity level value: 2.

$SourceName (type: string): Set to nxlog.

Examples

Example 1. Using the im_mark module

Here, NXLog will write the specified string to file every minute.

nxlog.conf

<Input mark>
    Module          im_mark
    MarkInterval    1
    Mark            -=| MARK |=-
</Input>

<Output file>
    Module          om_file
    File            "tmp/output"
</Output>

<Route mark_to_file>
    Path            mark => file
</Route>