Infrastructure agent logging not sending

I’ve been working on this for a week and support hasn’t been able to help. I have configured a Windows server with the Infrastructure agent which is nicely reporting to NewRelic. I’ve configured logging.d to forward event logs as well as syslogs from one of our Cisco ASA devices. The logging.d configs look to be loading in the verbose logging. I can see that it loads the logging.d YML files. There are no errors in the log. I do not have any logs in my NewRelic portal. It simply doesn’t work. I’ve followed the setup guide many times. The Infrastructure agent reports but logging.d does not. Any tips to look at that NewRelic may have missing from their guides?

I didn’t see this last week but since making some changes to my configs I’m receiving “did not find expected ‘-’” on line 2. So, I removed the two spaces before the dash and now receive the error “did not find expected key on line 2”. Does the logging feature actually work in windows?

Now I am receiving the error component-integrations.Supervisor error=“exit status 1” process=log-forwarder.

Hi there @dgaussiran - welcome to the community. I see that our support and product engineering teams are working on this together to see if they can find a resolution, but this looks to be an unusual situation. We’ll keep working on it, but I am also curious if any other customers have experienced this.

Thank you. I have done further testing. The host I’m having issues with is Windows Server 2019. One issue is that it is not listening on 514, the port I have specified in the logs.yml file. So, I installed the latest Infrastructure agent on another host which is Windows Server 2016 which has never had the agent installed. I configured the logs.yml on it for Winlogs and I can see it listening on 514 for UDP logs from our Cisco ASAs. The agent is reporting the node to the portal, but not logs. I think the latest version of the agent has an issue with logs ingestion.

It looks like there are at least two bugs in the latest version with logging.

My Windows Server 2019 box is now writing Winlogs to the portal. I had to point it directly out to the internet though. The Infrastructure agent logging.d integration DOES NOT WORK behind a proxy. I allowed this host unfettered access through my proxy and it still did not work. Once I NATed this server out to the internet through our firewall and removed the proxy setting from the config it worked.

I cannot get UDP working on Server 2019, at all. TCP listening ports work fine. I can modify the yml file with any TCP port I want and can see the server begin listening on it. The second I change ‘tcp’ to ‘udp’ the TCP port stops listening and UDP never starts. On Server 2016 UDP works fine.