-
Windows Agent Get Log Content From Plain Text File
Hello,
I’m trying to read the log content from a plain text file on a windows machine, with this configuration of a module:
module_begin
module_name Syslog
module_type log
module_regexp D:\Downloads\APPLOG20250723.DOC
module_pattern .*
module_endDon’t get scared by the .DOC extension, it’s not what it seems to be, it really is a plain text file.
After some time, nothing appears in the log viewer in the console and I cannot debug how the agent is trying to read the file or inserting the log data (if it really is reading the data).
I was testing with grep_log.exe (located in the util directory) but it seems to generate only async_string modules and it doesn’t seem to work always.
How can in get it working?
Regards
-
2 Replies
-
Hello,
Everything related to monitoring logs in Windows can be found in this link.
From what we can see the block seems to be ok.
Not sure if the .DOC file will work as intended, maybe trying to create a .TXT copy and see if that works.
Otherwise you can activate the debug mode of the agent and take a look at the .datasent file that will be generated inside the temp folder of the agent, that will be the exact replica of the XML sent to the server where you can see if the logs are being stored or not.
Also check the pandora_debug.log which will provide some information o wheather why is not being read properly.
Kind regards,
Sergio B.
-
Hi Sergio,
The DOC file is really a plain TXT file but with that extension.
I didn’t make it work with the agent’s integrated module type.
I tried activating the debug mode but it didn’t help (sometimes it read the content and sometimes it didn’t read anything).
Finally I ended building my own plugin to read the file and record the last read position (just like the linux plugin).
My plugin worked very well (with a customization that allows the plugin to read the log when the file name is generated automatically every day).
Best regards,
-
Log in to reply.