NetXMS Forum

Brill thanks Victor- we are running NetXMS on Windows, so may be a little different but I will look into your suggestions.

Meanwhile I figured rather than trying to write a clever regex to exclude certain things I could create rules which don't raise events. So I have ended up with something like;

  <rules>
    <rule>
      <match>Error\s\|\sOrder\shas\stimed\sout</match>
    </rule>
    <rule>
      <match>Error\s\|\sRetrieved\sPostcode:\s;</match>
    </rule>
    <rule>
      <match>Error\s\|\s(.*)</match>
      <event>100050</event>
    </rule>
  </rules>

Perhaps you want to set the Server Configuration parameter ImportConfigurationonStartup to 0? This did the trick for us.

I'm having a bit of a nightmare trying to configure some regular expressions (mainly because debugging is really tricky- having to keep restarting the agent, tweaking the xml, throwing some fake lines into the logfile etc etc).
Is there an easy way to test/troubleshoot my regular expressions?
I've used sites like https://regex101.com/ before, but it looks like the NetXMS engine works a little differently. https://www.regextester.com seemed to provide a slightly closer result but still not everything that works on there works in NetXMS.

Here an example of one I got working;
Error\s\|\s(.*)

Here's an example of one i'm struggling with (it's supposed to work similar to the above expression, matching anything after error but not if it contains the word timed);
Error\s\|\s(?!.*timed)(.*)

Any pointers would be great (as I say, rather somewhere I can test or a way in NetXMS I can debug more easily).
Thanks

Thanks Victor, putting the wildcards straight in the filename as you suggested worked perfectly;

<file>C:\inetpub\wwwroot\website\logs\Log_%Y_%m_%d.txt</file>

• I am trying this (dynamic filename) and struggling- I have tried;
  • using a wildcard * (didn't expect it to work, but worth a longshot)
• adding a macro (see below)
• using backticks with an echo command directly
• using backticks with a batch file which executes an echo command

<macro name="timestamp">%Y_%m_%d</macro>

The log file seems to show whatever I enter and doesn't appear to show a "resolved" value. Is this normal? Regardless new log entries don't appear to be picked up.

2019.04.11 09:31:02.328 *D* [logwatch           ] Parser thread for file "C:\inetpub\wwwroot\website\logs\Log_@{timestamp}.txt" stopped
2019.04.11 16:33:00.121 *D* [logwatch           ] Parser thread for file "C:\inetpub\wwwroot\website\logs\Log_`echo %date:~6,4%_%date:~3,2%_%date:~0,2%`.txt" started
2019.04.11 16:38:34.340 *D* [logwatch           ] Parser thread for file "C:\inetpub\wwwroot\website\logs\Log_*.txt" stopped
2019.04.11 16:38:34.906 *D* [logwatch           ] Parser thread for file "C:\inetpub\wwwroot\website\logs\Log_`c:\netxms\etc\date.bat`.txt" started

I have the parser working fine for the Windows Event Log.

Any ideas? TIA

Thanks Victor

same problem here in latest version 2.0.4 (works in NetXMS Management Console but not in Web Interface)

Same problem here latest version 2.0.4