We have successfully implemented to sending logs from Zerto Virtual Manager to our Graylog Syslog Infrastructure. We have done this with nxlog and its csv extension. It is working fine except for one issue:
All 10 minutes the ZVM writes multiline messages to the csv log (C:\Program Files\Zerto\Zerto Virtual Replication\logs):
00000000,00000000,18-04-27 13:48:42.31,I,389,VraInUseMapper,<.ctor>b__7_0,Begin Method: GetLocalVraUsageInfo() VPG Identifier: 7a1147e3-3593-4437-960c-5e8410de6993 VPG Promoting: False VPG In Test Or Recover Before Commit: False VM Replication Identifier: 54899c25-d51e-48ec-b993-2de17be20bc4 VM Provisioned Size In MB: 81920 ....... End Method: GetLocalVraUsageInfo() ",
And I’ve got no possibility to parse those multiline messages because I can either parse single line or multi line messages at once. And here comes the real problem. nxlog sends each line as a syslog message to our graylog server and this server tries to parse those messages but fails and goes crazy (message processing last for about 5 minutes) and blocks other messages from being processed.
And all other log messages in the ZVM are single line:
00000000,f7a56b5b,18-04-27 13:48:42.56,I,386,StatisticsCollector,GetTestInfo,Refreshing test information, 00000000,f7a56b5b,18-04-27 13:48:42.56,I,386,StatisticsCollector,GetTestInfo,Refreshed test information, 00000000,00000000,18-04-27 13:48:42.61,D,143,MedianPerformanceCounter,CalculateValue,start value calculation, 00000000,c697a66a,18-04-27 13:48:42.64,I,10,VqCacheBuilder,BuildCache,called,
Does anyone have a solution for this or implemented syslog with another software?
Unfortunately I don’t have a solution for you today, but our team at Zerto is working on a alpha approach to handling syslog that may help. I will keep you updated on our progress.