# Corrupt winlogbeat.yml checkpoint file **URL:** \ **Category:** Beats\ **Tags:** winlogbeat\ **Created:** [August 19, 2016, 1:25am UTC](https://discuss.elastic.co/t/corrupt-winlogbeat-yml-checkpoint-file/58417 "2016-08-19T01:25:13Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![mcgrew](https://avatars.discourse-cdn.com/v4/letter/m/6f9a4e/32.png) [@mcgrew](https://discuss.elastic.co/u/mcgrew)\ **Post date:** [August 19, 2016, 1:25am UTC](https://discuss.elastic.co/t/corrupt-winlogbeat-yml-checkpoint-file/58417/1 "2016-08-19T01:25:13Z")
I'm using 5.0.0-alpha4 and I noticed that on some users the service was not able to start up. The following error was in the log file: 2016-08-18T18:22:56-07:00 CRIT Exiting: yaml: control characters are not allowed I noticed that the C:\ProgramData\winlogbeat\winlogbeat.yml file was blank with all zeroes. ``` # xxd winlogbeat.yml 0000000: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 0000010: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 0000020: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 0000030: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 0000040: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 0000050: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 0000060: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 0000070: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 0000080: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 0000090: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000a0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000b0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000c0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ ``` Is this a known problem? ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [August 19, 2016, 1:27am UTC](https://discuss.elastic.co/t/corrupt-winlogbeat-yml-checkpoint-file/58417/2 "2016-08-19T01:27:30Z")
Was there any sort of machine failure or power outage? ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [August 19, 2016, 1:29am UTC](https://discuss.elastic.co/t/corrupt-winlogbeat-yml-checkpoint-file/58417/3 "2016-08-19T01:29:45Z")
There was one similar report. See [Winlogbeat v5 fail to start after upgrade](https://discuss.elastic.co/t/winlogbeat-v5-fail-to-start-after-upgrade/47483/10?u=andrewkroh) ---
**Author:** ![mcgrew](https://avatars.discourse-cdn.com/v4/letter/m/6f9a4e/32.png) [@mcgrew](https://discuss.elastic.co/u/mcgrew)\ **Post date:** [August 19, 2016, 1:44am UTC](https://discuss.elastic.co/t/corrupt-winlogbeat-yml-checkpoint-file/58417/4 "2016-08-19T01:44:18Z")
That's hard to tell. They're just client laptop systems, they could have ran out of battery, crashed, been shut down, lid closed etc. No way of knowing with users 😉 ---
**Author:** ![mcgrew](https://avatars.discourse-cdn.com/v4/letter/m/6f9a4e/32.png) [@mcgrew](https://discuss.elastic.co/u/mcgrew)\ **Post date:** [August 19, 2016, 1:47am UTC](https://discuss.elastic.co/t/corrupt-winlogbeat-yml-checkpoint-file/58417/5 "2016-08-19T01:47:46Z")
Perhaps that error ("control characters are not allowed") can be caught and the file wiped out and a new one created. ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [August 19, 2016, 1:48am UTC](https://discuss.elastic.co/t/corrupt-winlogbeat-yml-checkpoint-file/58417/6 "2016-08-19T01:48:54Z")
About how many systems have been affected by the problem so far? ---
**Author:** ![mcgrew](https://avatars.discourse-cdn.com/v4/letter/m/6f9a4e/32.png) [@mcgrew](https://discuss.elastic.co/u/mcgrew)\ **Post date:** [August 19, 2016, 1:59am UTC](https://discuss.elastic.co/t/corrupt-winlogbeat-yml-checkpoint-file/58417/7 "2016-08-19T01:59:41Z")
About 40 out of a few hundred. ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [August 19, 2016, 2:06am UTC](https://discuss.elastic.co/t/corrupt-winlogbeat-yml-checkpoint-file/58417/8 "2016-08-19T02:06:02Z")
Could you please open a [new Github issue](https://github.com/elastic/beats/issues/new) for this and we'll see what we can do to mitigate the problem. It sounds pretty serious if it's happening on a ~40 machines. Thanks! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 9, 2016, 2:06am UTC](https://discuss.elastic.co/t/corrupt-winlogbeat-yml-checkpoint-file/58417/9 "2016-09-09T02:06:11Z")
This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.