• This topic has 1 reply, 2 voices, and was last updated November 27, 2018 by Robert M.

ZVM Syslog Intergration with nxLog

  • Hi together

    We have successfully implemented to sending logs from Zerto Virtual Manager to our Graylog Syslog Infrastructure. We have done this with nxlog and its csv extension. It is working fine except for one issue:
    All 10 minutes the ZVM writes multiline messages to the csv log (C:\Program Files\Zerto\Zerto Virtual Replication\logs):

    00000000,00000000,18-04-27 13:48:42.31,I,389,VraInUseMapper,<.ctor>b__7_0,Begin Method: GetLocalVraUsageInfo()
     VPG Identifier: 7a1147e3-3593-4437-960c-5e8410de6993
     VPG Promoting: False
     VPG In Test Or Recover Before Commit: False
     VM Replication Identifier: 54899c25-d51e-48ec-b993-2de17be20bc4
     VM Provisioned Size In MB: 81920
     .......
     End Method: GetLocalVraUsageInfo()
     ",

    And I’ve got no possibility to parse those multiline messages because I can either parse single line or multi line messages at once. And here comes the real problem. nxlog sends each line as a syslog message to our graylog server and this server tries to parse those messages but fails and goes crazy (message processing last for about 5 minutes) and blocks other messages from being processed.

    And all other log messages in the ZVM are single line:

    00000000,f7a56b5b,18-04-27 13:48:42.56,I,386,StatisticsCollector,GetTestInfo,Refreshing test information,
    00000000,f7a56b5b,18-04-27 13:48:42.56,I,386,StatisticsCollector,GetTestInfo,Refreshed test information,
    00000000,00000000,18-04-27 13:48:42.61,D,143,MedianPerformanceCounter,CalculateValue,start value calculation,
    00000000,c697a66a,18-04-27 13:48:42.64,I,10,VqCacheBuilder,BuildCache,called,

    Does anyone have a solution for this or implemented syslog with another software?

    Thanks

     

    Tobi

    Hi Tobi,

    Unfortunately I don’t have a solution for you today, but our team at Zerto is working on a alpha approach to handling syslog that may help. I will keep you updated on our progress.

     

    Regards,

     

    Bob

The forum ‘General Discussion’ is closed to new topics and replies.