Relocating NXLog

While not officially supported, it is possible to relocate NXLog to a different directory than where it was installed originally. The procedure shown below assumes that NXLog was installed normally, using the system’s package manager. While it is also possible to manually extract the files from the package and perform a manual installation in a custom directory, this is not covered here but the basic principals are the same. This procedure has been tested in GNU/Linux systems and should work in any system that supports run-time search paths.

Both relocation and manual installation can result in a non-functional NXLog agent. Furthermore, subsequent update and removal using the system’s package manager may not work correctly. Follow this procedure at your own risk. This is not recommended for inexperienced users.

Move the NXLog directory structure to the new location. Though not required, it is best to keep the original directory structure. Then proceed to the following sections.

In the examples that follow, NXLog is being relocated from /opt/nxlog to /opt/nxlog_new.

System V Init File

For systems that manage services with System V, edit the NXLog init file. This file can normally be found at /etc/init.d/nxlog. Modify the init file so that the $BASE variable reflects the new directory. Update the $pidfile, $nxlog, and $conf variables to reference $BASE. Finally, reassign the $nxlog variable to include the configuration file. This must be done after any tests to the binary executable. The init file should look similar to the following.

/etc/init.d/nxlog

BASE=/opt/nxlog_new

pidfile=$BASE/var/run/nxlog/nxlog.pid
nxlog=$BASE/bin/nxlog
conf=$BASE/etc/nxlog.conf

test -f $nxlog || exit 0

nxlog="$nxlog -c $conf"

On systems that use a hybrid System V and systemd, reload the init files by executing the following command.

# systemctl daemon-reload

Systemd Unit File

For systems using systemd, the /lib/systemd/system/nxlog.service unit file must be edited and the paths updated.

nxlog.service

[Service]
Type=simple
User=root
Group=root
PIDFile=/opt/nxlog_new/var/run/nxlog/nxlog.pid
ExecStartPre=/opt/nxlog_new/bin/nxlog -v -c /opt/nxlog_new/etc/nxlog.conf
ExecStart=/opt/nxlog_new/bin/nxlog -f -c /opt/nxlog_new/etc/nxlog.conf
ExecStop=/opt/nxlog_new/bin/nxlog -s -c /opt/nxlog_new/etc/nxlog.conf
ExecReload=/opt/nxlog_new/bin/nxlog -r -c /opt/nxlog_new/etc/nxlog.conf
KillMode=process

Reload the modified unit files by executing the following command.

# systemctl daemon-reload

NXLog Configuration File

The configuration file of NXLog itself must be modified to reflect the directory relocation, as well as any changes in the directory structure. For most cases, running the following command will update the configuration file.

# sed -i s,/opt/nxlog,/opt/nxlog_new,g /opt/nxlog_new/etc/nxlog.conf

Alternatively, the file can be manually edited as shown below.

nxlog.conf

define BASE /opt/nxlog_new
define CERTDIR %BASE%/var/lib/nxlog/cert
define CONFDIR %BASE%/etc/nxlog.d
define LOGDIR %BASE%/var/log/nxlog
define LOGFILE "%LOGDIR%/nxlog.log"

SpoolDir %BASE%/var/spool/nxlog

# default values:
PidFile %BASE%/var/run/nxlog/nxlog.pid
CacheDir %BASE%/var/spool/nxlog
ModuleDir %BASE%/lib/nxlog/modules

Depending on the architecture and whether system supplied libraries are used, NXLog will store the modules under a different directory such as %BASE%/libexec/nxlog/modules.

Modify rpath

Depending on the NXLog package used, the run-time search path of the binaries must be changed. This is relevant for the generic versions of NXLog in which the libraries are statically linked against the binaries. To list the shared libraries used by NXLog, use the ldd command with the full path to the nxlog binary

# ldd /opt/nxlog_new/bin/nxlog

The output should look similar to this:

        linux-vdso.so.1 =>  (0x00007ffc15d36000)
        libpcre.so.1 => /opt/nxlog/lib/libpcre.so.1 (0x00007ff7f311e000)
        libdl.so.2 => /lib64/libdl.so.2 (0x00007ff7f2f14000)
        libcap.so.2 => /lib64/libcap.so.2 (0x00007ff7f2d0f000)
        libapr-1.so.0 => /opt/nxlog/lib/libapr-1.so.0 (0x00007ff7f2ad9000)
        librt.so.1 => /lib64/librt.so.1 (0x00007ff7f28d0000)
        libcrypt.so.1 => /lib64/libcrypt.so.1 (0x00007ff7f2699000)
        libpthread.so.0 => /lib64/libpthread.so.0 (0x00007ff7f247d000)
        libc.so.6 => /lib64/libc.so.6 (0x00007ff7f20bb000)
        /lib64/ld-linux-x86-64.so.2 (0x00007ff7f336d000)
        libattr.so.1 => /lib64/libattr.so.1 (0x00007ff7f1eb6000)
        libfreebl3.so => /lib64/libfreebl3.so (0x00007ff7f1cb3000)

Notice that libpcre and libapr are pointing to the included libraries in /opt/nxlog/lib/. To change the run-time search path of the binaries, a tool such as chrpath or patchelf can be used.

Depending on the distribution, chrpath may have a limitation on the path length for the -r <path> | --replace <path> option: "The new path must be shorter or the same length as the current path."

# chrpath -r /opt/nxlog_new/lib /opt/nxlog_new/bin/nxlog

Returns this error:

  /opt/nxlog_new/bin/nxlog: RUNPATH=/opt/nxlog/lib
  new rpath '/opt/nxlog_new/lib' too large; maximum length 14

If your system has the chrpath limitation documented above, skip to Modifying rpath with patchelf.

Modifying rpath with chrpath

If the current rpath is longer than the new rpath, issue the following command if the nxlog binary is in your current path. Otherwise, the final chrpath argument needs to include the appropriate relative or absolute path to nxlog (as implemented in the example above).

# chrpath -r /opt/nxlog_new/lib nxlog

Upon success, a message similar to this will be output:

nxlog: RPATH=/opt/nxlog/lib:/home/builder/workspace/nxlog3-rpm-generic-amd64/rpmbuild/BUILD/nxlog-deps/opt/nxlog/lib
nxlog: new RPATH: /opt/nxlog_new/lib

# chrpath -r /opt/nxlog_new/lib *

NXLog is now successfully relocated to a new directory.

Modifying rpath with patchelf

If chrpath is not an option for modifying rpath, using patchelf as follows will achieve the same goal:

# patchelf --set-rpath /opt/nxlog_new/lib /opt/nxlog_new/bin/nxlog

On success the command prompt returns with no message, or if this is the first time patchelf has been run after installation, the following warning will be shown:

warning: working around a Linux kernel bug by creating a hole of 1748992 bytes in ‘nxlog’

To confirm the modification of rpath, run ldd again on the binary. The new path should displayed in the output:

# ldd /opt/nxlog_new/bin/nxlog
        linux-vdso.so.1 =>  (0x00007ffc15d36000)
        libpcre.so.1 => /opt/nxlog_new/lib/libpcre.so.1 (0x00007ff7f311e000)
        libdl.so.2 => /lib64/libdl.so.2 (0x00007ff7f2f14000)
        libcap.so.2 => /lib64/libcap.so.2 (0x00007ff7f2d0f000)
        libapr-1.so.0 => /opt/nxlog_new/lib/libapr-1.so.0 (0x00007ff7f2ad9000)
        librt.so.1 => /lib64/librt.so.1 (0x00007ff7f28d0000)
        libcrypt.so.1 => /lib64/libcrypt.so.1 (0x00007ff7f2699000)
        libpthread.so.0 => /lib64/libpthread.so.0 (0x00007ff7f247d000)
        libc.so.6 => /lib64/libc.so.6 (0x00007ff7f20bb000)
        /lib64/ld-linux-x86-64.so.2 (0x00007ff7f336d000)
        libattr.so.1 => /lib64/libattr.so.1 (0x00007ff7f1eb6000)
        libfreebl3.so => /lib64/libfreebl3.so (0x00007ff7f1cb3000)

NXLog modules are also linked against statically included libraries. Therefore, if the run-time search path of the binaries required a change, then the rpath of the modules needs updated as well. Unlike chrpath which accepts a (*) wildcard for all modules (or binaries) in a given directory, patchelf can only be run on a single file. To automate the process of changing rpath on multiple files, a shell script will need to be written if relocating NXLog will need to be done on a regular basis, or on more than one installation.