Mark (im_mark)

Mark messages are used to indicate periodic activity and ensure NXLog Agent is running when log sources are not sending logs.

To examine the supported platforms, see the list of installation packages.

By default, if no module-specific directives are set, a log message will be generated every 30 minutes containing -- MARK --.

The $raw_event field is not generated in syslog format. If mark messages are required in syslog format, they must be explicitly converted with the to_syslog_bsd() procedure.

The functionality of the im_mark module can be also achieved using the Schedule block with a log_info("--MARK--") Exec statement, which would insert the messages via the im_internal module into a route. Using a single module for this task can simplify configuration.

Configuration

The im_mark module accepts the following directives in addition to the common module directives.

Optional directives

Mark

This optional directive sets the string for the mark message. The default is -- MARK --.

MarkInterval

This optional directive sets the interval for mark messages, in minutes. The default is 30 minutes.

Fields

The following fields are used by im_mark.

$raw_event (type: string): A list of event fields in key-value pairs.

$EventTime (type: datetime): The current time.

$Message (type: string): The same value as $raw_event.

$ProcessID (type: integer): The process ID of the NXLog Agent process.

$Severity (type: string): The severity name: INFO.

$SeverityValue (type: integer): The INFO severity level value: 2.

$SourceName (type: string): Set to nxlog.

Examples

Example 1. Using the im_mark module

Here, NXLog Agent will write the specified string to file every minute.

nxlog.conf

<Input mark>
    Module          im_mark
    MarkInterval    1
    Mark            -=| MARK |=-
</Input>

<Output file>
    Module          om_file
    File            "tmp/output"
</Output>

<Route mark_to_file>
    Path            mark => file
</Route>