Cannot start service winlogbeat in Docker Windows Container

Elastic Stack Beats
1

I have looked through all the existing posts on this but I am still struggling with getting the service to run.

I am using Chocolaty to install winlogbeat inside my windows container, (1809). Everything install fine, I can run it directly from the command line in the container but the service doesn't start. I get error saying that it couldn't start from the command line and looking at the logs it shows it couldn't start in a timely manner and quits.

2

I haven't used Windows containers, but running the service sounds like the wrong approach. Normally (at least with Linux) you want the ENTRYPOINT or CMD to directly execute the beat process and keep running. Like

CMD .\winlogbeat.exe -e

Could that work?

3

Thanks but , I am looking for the proper way to run this on a windows container. The installer works fine it creates the service it just wont start. If i run the same thing from a command line it works fine. Even if the proper way is to run it as a process I would still like to understand why the service doesn't start.

Sorry for the delay in responding I was away on vacation

I want to establish a best practice for windows containers at my company so I am hoping to get an official stance on the above.

4

I am suggesting that the right way is to set the ENTRYPOINT or CMD as winlogbeat.exe and not to use a service manager from within a container. When you run an application in a container, Docker monitors the active process in the container. If the active process (PID=1) stops, the container exits.

This also ensures that logs from the process are directly available via docker logs.

5

great thanks im new to containers so this is helpful. Just for curiosity sake services also get a PID is this not the case with containers? and i guess I am still curious as to why the service didnt start? there wastn any logs in winlogbeat created but I only found vague info in the event logs and cryptic errors when starting the service in powershell

6

Andrew any thoughts on the above?

7

PID 1 is all that matters when determining if a container will exit. So you need to keep the containers main process running in order to prevent the container from exiting and stopping any other processes that may be running in the container (like those started by a service manager).

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.