# Cannot stop winlogbeat service

**URL:** <https://discuss.elastic.co/t/cannot-stop-winlogbeat-service/340653>\
**Category:** Elasticsearch\
**Created:** [August 11, 2023, 3:58pm UTC](https://discuss.elastic.co/t/cannot-stop-winlogbeat-service/340653 "2023-08-11T15:58:33Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ptak](https://avatars.discourse-cdn.com/v4/letter/p/c89c15/32.png) [@Ptak](https://discuss.elastic.co/u/Ptak)\
**Post date:** [August 11, 2023, 3:58pm UTC](https://discuss.elastic.co/t/cannot-stop-winlogbeat-service/340653/1 "2023-08-11T15:58:33Z")

</div>

Hello all,

I'm facing the following issue: I cannot stop the winlogbeat service either automatically or manually. The service can be stopped only after clicking "End Task" in the Task Manager. I did test the same Ansible role against several servers on-premises and in the cloud.

If I try to do it manually (run Power Shell as Admin):

```auto
PS C:\Program Files\Winlogbeat> .\uninstall-service-winlogbeat.ps1
Stop-Service : Service 'winlogbeat (winlogbeat)' cannot be stopped due to the following error: Cannot stop winlogbeat
service on computer ''.''.'

At C:\Program Files\Winlogbeat\uninstall-service-winlogbeat.ps1:3 char:3
+ Stop-Service winlogbeat
+ ~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo : CloseError: (System.ServiceProcess.ServiceController:ServiceController) [Stop-Service],
   ServiceCommandException
    + FullyQualifiedErrorId : CouldNotStopService,Microsoft.PowerShell.Commands.StopServiceCommand

```

```auto

```

After that, the Power Shell hangs completely and the winlogbeat service is in a permanent Stopping state.

But when I "End Task" in the Task Manager it works fine.

---

<div class="post-metadata">

**Author:** ![Ptak](https://avatars.discourse-cdn.com/v4/letter/p/c89c15/32.png) [@Ptak](https://discuss.elastic.co/u/Ptak)\
**Post date:** [August 15, 2023, 8:53am UTC](https://discuss.elastic.co/t/cannot-stop-winlogbeat-service/340653/2 "2023-08-15T08:53:01Z")

</div>

Hello all,

The problem is solved. The root cause - failed DNS Lookup:

`{"log.level":"error","log.logger":"publisher_pipeline_output","log.origin":{"file.name":"pipeline/client_worker.go","file.line":148},"message":"Failed to connect to backoff(async(tcp:/*****************:5046)): lookup**************: no such host","service.name":"winlogbeat","ecs.version":"***"}`

Winlogbeat is failing to connect to the Elasticsearch server due to a DNS lookup failure for the hostname ` *************** ` . The system can't resolve this hostname to an IP address.

This might be considered a bug; in the case of Connectivity issues, we cannot manage the Winlogbeat Service from an Operating System perspective. Also, we have no output that indicates the network connectivity issue. As a conclusion, all the Automation gets stuck.

winlogbeat-8.8.2

Please let me know your thoughts on this.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 12, 2023, 8:53am UTC](https://discuss.elastic.co/t/cannot-stop-winlogbeat-service/340653/3 "2023-09-12T08:53:04Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.