Logstash (Running as Windows Service) - cannot obtain logs from Windows Network Drive

Hi Everyone,

I'm having issue to get Logstash to send logs from Windows network drive while running it as Windows Service (using NSSM), it works perfectly fine using the CLI.

Here's the logstash.conf:

input {
  file {
   path => "c:/sample.log"
   path => "c:/networklog/sample.log"
   path => "//sample-test-winvm-002/networkdrive/location1/sample.log"
#   path => "//10.0.0.22/networkdrive/location1/sample.log"
#   path => "z:/location1/sample.log"
  }
}

From the debug logs, I can see the following messages in a loop when I append test log message to my log file in the remote network drive:

[2021-11-03T07:03:15,137][DEBUG][logstash.instrument.periodicpoller.jvm] collector name {:name=>"ParNew"}
[2021-11-03T07:03:15,138][DEBUG][logstash.instrument.periodicpoller.jvm] collector name {:name=>"ConcurrentMarkSweep"}
[2021-11-03T07:03:15,266][DEBUG][logstash.instrument.periodicpoller.cgroup] One or more required cgroup files or directories not found: /proc/self/cgroup, /sys/fs/cgroup/cpuacct, /sys/fs/cgroup/cpu
[2021-11-03T07:03:16,446][DEBUG][logstash.pipeline        ] Pushing flush onto pipeline {:pipeline_id=>"main", :thread=>"#<Thread:0x3b16e697 sleep>"}
[2021-11-03T07:03:20,152][DEBUG][logstash.instrument.periodicpoller.jvm] collector name {:name=>"ParNew"}
[2021-11-03T07:03:20,154][DEBUG][logstash.instrument.periodicpoller.jvm] collector name {:name=>"ConcurrentMarkSweep"}
[2021-11-03T07:03:20,280][DEBUG][logstash.instrument.periodicpoller.cgroup] One or more required cgroup files or directories not found: /proc/self/cgroup, /sys/fs/cgroup/cpuacct,```

~~
In short, tried the following but still has no clue:

1. Mapped the network drive - no go;
2. Netlink - no go;
3. Tried both v6.7 and v7.11.x - no go;

Did I overlooked anything? Any help would be much appreciated.

Thanks,

Is the same user running CLI and service?
Maybe your files were read, perhaps to delete the file registry database (sincedb_path).

1 Like

Hi Rios, thanks for the help, in short using the same user for both cli and windows.service.

Let me delete sinceDB file, finger-crossed. Just want to double check is my conf file syntax is correct. Thanks

If the file input is not reading the file as you expect it to then enable log.level TRACE. The filewatch module will then log messages about what it is doing.

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.