Error while running wmi input plugin

maxf · August 2, 2017, 9:31am

Hello.
Im trying to run wmi input plugin, but i got only errors "Bad file descriptor"

My config:

input {

wmi {
query => "SELECT * FROM Win32_Process"
host => "hostname"
user => "DOMAIN\USER"
password => "mypassword"
interval => 1
}
}

My log:

[2017-08-02T13:51:30,457][DEBUG][logstash.codecs.plain [2017-08-02T13:51:30,458][DEBUG][logstash.codecs.plain [2017-08-02T13:51:30,458][DEBUG][logstash.codecs.plain [2017-08-02T13:51:30,458][DEBUG][logstash.inputs.wmi [2017-08-02T13:51:30,458][DEBUG][logstash.inputs.wmi [2017-08-02T13:51:30,458][DEBUG][logstash.inputs.wmi [2017-08-02T13:51:30,459][DEBUG][logstash.inputs.wmi [2017-08-02T13:51:30,459][DEBUG][logstash.inputs.wmi [2017-08-02T13:51:30,459][DEBUG][logstash.inputs.wmi [2017-08-02T13:51:30,459][DEBUG][logstash.inputs.wmi [2017-08-02T13:51:30,459][DEBUG][logstash.inputs.wmi [2017-08-02T13:51:30,459][DEBUG][logstash.inputs.wmi [2017-08-02T13:51:30,463][DEBUG][logstash.inputs.wmi [2017-08-02T13:51:30,467][DEBUG][logstash.plugins.registry] [2017-08-02T13:51:30,473][DEBUG][logstash.plugins.registry] [2017-08-02T13:51:30,475][DEBUG][logstash.codecs.jsonlines] [2017-08-02T13:51:30,475][DEBUG][logstash.codecs.jsonlines] [2017-08-02T13:51:30,475][DEBUG][logstash.codecs.jsonlines] [2017-08-02T13:51:30,475][DEBUG][logstash.codecs.jsonlines] [2017-08-02T13:51:30,476][DEBUG][logstash.outputs.file [2017-08-02T13:51:30,476][DEBUG][logstash.outputs.file [2017-08-02T13:51:30,476][DEBUG][logstash.outputs.file [2017-08-02T13:51:30,477][DEBUG][logstash.outputs.file [2017-08-02T13:51:30,477][DEBUG][logstash.outputs.file [2017-08-02T13:51:30,477][DEBUG][logstash.outputs.file [2017-08-02T13:51:30,477][DEBUG][logstash.outputs.file [2017-08-02T13:51:30,477][DEBUG][logstash.outputs.file [2017-08-02T13:51:30,477][DEBUG][logstash.outputs.file [2017-08-02T13:51:30,477][DEBUG][logstash.outputs.file [2017-08-02T13:51:30,477][DEBUG][logstash.outputs.file [2017-08-02T13:51:30,501][DEBUG][logstash.agent [2017-08-02T13:51:30,505][DEBUG][logstash.agent [2017-08-02T13:51:30,517][INFO ][logstash.pipeline [2017-08-02T13:51:30,520][INFO ][logstash.inputs.wmi [2017-08-02T13:51:30,582][DEBUG][logstash.agent [2017-08-02T13:51:30,583][DEBUG][logstash.agent [2017-08-02T13:51:30,586][DEBUG][logstash.api.service [2017-08-02T13:51:30,619][INFO ][logstash.agent [2017-08-02T13:51:30,718][DEBUG][logstash.agent [2017-08-02T13:51:30,719][DEBUG][logstash.agent [2017-08-02T13:51:30,720][DEBUG][logstash.agent /usr/share/logstash/vendor/bundle/jruby/1.9/gems/pum [2017-08-02T13:51:30,722][DEBUG][logstash.agent ] config LogStash::Codecs::Plain/@ id = "plain_10eb85f5-9492-47a6-9bf6-c50f16599d43"
] config LogStash::Codecs::Plain/@ enable_metric = true
] config LogStash::Codecs::Plain/@ charset = "UTF-8"
] config LogStash::Inputs::WMI/@ query = "SELECT * FROM Win32_Process"
] config LogStash::Inputs::WMI/@ host = "hostname"
] config LogStash::Inputs::WMI/@ user = "DOMAIN\USER"
] config LogStash::Inputs::WMI/@ password =
] config LogStash::Inputs::WMI/@ interval = 1
] config LogStash::Inputs::WMI/@ id = "a1be0c6204884666809dc11fde693c956c8ea208-1"
] config LogStash::Inputs::WMI/@ enable_metric = true
] config LogStash::Inputs::WMI/@ codec = <LogStash::Codecs::Plain id=>"plain_10eb85f5-9492-47a6-9bf6-c50f16599d43", enable_metric=>true, charset=>"UTF-8">
] config LogStash::Inputs::WMI/@ add_field = {}
] config LogStash::Inputs::WMI/@ namespace = "root\cimv2"
On demand adding plugin to the registry {:name=>"file", :type=>"output", :class=>LogStash::Outputs::File}
On demand adding plugin to the registry {:name=>"json_lines", :type=>"codec", :class=>LogStash::Codecs::JSONLines}
config LogStash::Codecs::JSONLines/@ id = "json_lines_2a3a2720-6d36-4688-850e-aeb026f171bf"
config LogStash::Codecs::JSONLines/@ enable_metric = true
config LogStash::Codecs::JSONLines/@ charset = "UTF-8"
config LogStash::Codecs::JSONLines/@ delimiter = "\n"
] config LogStash::Outputs::File/@ path = "/tmp/alert2"
] config LogStash::Outputs::File/@ id = "a1be0c6204884666809dc11fde693c956c8ea208-2"
] config LogStash::Outputs::File/@ enable_metric = true
] config LogStash::Outputs::File/@ codec = <LogStash::Codecs::JSONLines id=>"json_lines_2a3a2720-6d36-4688-850e-aeb026f171bf", enable_metric=>true, charset=>"UTF-8", delimiter=>"\n">
] config LogStash::Outputs::File/@ workers = 1
] config LogStash::Outputs::File/@ flush_interval = 2
] config LogStash::Outputs::File/@ gzip = false
] config LogStash::Outputs::File/@ filename_failure = "_filepath_failures"
] config LogStash::Outputs::File/@ create_if_deleted = true
] config LogStash::Outputs::File/@ dir_mode = -1
] config LogStash::Outputs::File/@ file_mode = -1
] starting agent
] starting pipeline {:id=>"main"}
] Starting pipeline {"id"=>"main", "pipeline.workers"=>4, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>5, "pipeline.max_inflight"=>500}
] Registering wmi input {:query=>"SELECT * FROM Win32_Process"}
] Starting puma
] Trying to start WebServer {:port=>9600}
] [api-service] start
] Successfully started Logstash API endpoint {:port=>9600}
] Error in reactor loop escaped: Bad file descriptor - Bad file descriptor (Errno::EBADF)
] 2017-08-02 13:51:30 +0500: Listen loop error: #<Errno::EBADF: Bad file descriptor - Bad file descriptor>
] org/jruby/RubyIO.java:3705:in select' /usr/share/logstash/vendor/bundle/jruby/1.9/gems/puma-2.16.0-java/lib/puma/server.rb:322:in handle_servers'
a-2.16.0-java/lib/puma/server.rb:296:in run' [2017-08-02T13:51:30,720][DEBUG][logstash.agent ] ["org/jruby/RubyIO.java:3705:in select'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/puma-2.16.0-java/lib/puma/reactor.rb:29:in run_internal'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/puma-2.16.0-java/lib/puma/reactor.rb:138:in run_in_thread'"]
] Error in reactor loop escaped: Bad file descriptor - Bad file descriptor (Errno::EBADF)

So what am i doing wrong?

system · August 30, 2017, 9:32am

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.