Logstash (Running as Windows Service) - cannot obtain logs from Windows Network Drive

[coldycc (Charles Choy)]

Hi Everyone,

I'm having issue to get Logstash to send logs from Windows network drive while running it as Windows Service (using NSSM), it works perfectly fine using the CLI.

Here's the logstash.conf:

input {
  file {
   path => "c:/sample.log"
   path => "c:/networklog/sample.log"
   path => "//sample-test-winvm-002/networkdrive/location1/sample.log"
#   path => "//10.0.0.22/networkdrive/location1/sample.log"
#   path => "z:/location1/sample.log"
  }
}

From the debug logs, I can see the following messages in a loop when I append test log message to my log file in the remote network drive:

[2021-11-03T07:03:15,137][DEBUG][logstash.instrument.periodicpoller.jvm] collector name {:name=>"ParNew"}
[2021-11-03T07:03:15,138][DEBUG][logstash.instrument.periodicpoller.jvm] collector name {:name=>"ConcurrentMarkSweep"}
[2021-11-03T07:03:15,266][DEBUG][logstash.instrument.periodicpoller.cgroup] One or more required cgroup files or directories not found: /proc/self/cgroup, /sys/fs/cgroup/cpuacct, /sys/fs/cgroup/cpu
[2021-11-03T07:03:16,446][DEBUG][logstash.pipeline        ] Pushing flush onto pipeline {:pipeline_id=>"main", :thread=>"#<Thread:0x3b16e697 sleep>"}
[2021-11-03T07:03:20,152][DEBUG][logstash.instrument.periodicpoller.jvm] collector name {:name=>"ParNew"}
[2021-11-03T07:03:20,154][DEBUG][logstash.instrument.periodicpoller.jvm] collector name {:name=>"ConcurrentMarkSweep"}
[2021-11-03T07:03:20,280][DEBUG][logstash.instrument.periodicpoller.cgroup] One or more required cgroup files or directories not found: /proc/self/cgroup, /sys/fs/cgroup/cpuacct,```

~~
In short, tried the following but still has no clue:

1. Mapped the network drive - no go;
2. Netlink - no go;
3. Tried both v6.7 and v7.11.x - no go;

Did I overlooked anything? Any help would be much appreciated.

Thanks,

[Rios]

Is the same user running CLI and service?
Maybe your files were read, perhaps to delete the file registry database (sincedb_path).

[coldycc (Charles Choy)]

Hi Rios, thanks for the help, in short using the same user for both cli and windows.service.

Let me delete sinceDB file, finger-crossed. Just want to double check is my conf file syntax is correct. Thanks

[Badger]

If the file input is not reading the file as you expect it to then enable log.level TRACE. The filewatch module will then log messages about what it is doing.