# Is it a bug in Winlogbeat?

**URL:** https://discuss.elastic.co/t/is-it-a-bug-in-winlogbeat/162011
**Category:** Beats
**Tags:** winlogbeat
**Created:** [December 24, 2018, 4:09pm UTC](https://discuss.elastic.co/t/is-it-a-bug-in-winlogbeat/162011 "2018-12-24T16:09:46Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![James\_Ronaldo](https://avatars.discourse-cdn.com/v4/letter/j/b9bd4f/32.png) [@James\_Ronaldo](https://discuss.elastic.co/u/James_Ronaldo)
#### Post date: [December 24, 2018, 4:09pm UTC](https://discuss.elastic.co/t/is-it-a-bug-in-winlogbeat/162011/1 "2018-12-24T16:09:46Z")

</div>

Source code: [https://github.com/elastic/beats/blob/master/winlogbeat/eventlog/wineventlog.go](https://github.com/elastic/beats/blob/master/winlogbeat/eventlog/wineventlog.go).

In the Open method (around line 125), a Windows event named signalEvent is created and then passed to win.Subscribe, however, it has never been released (by calling windows.Close).

On the related [MSDN page](https://docs.microsoft.com/en-us/windows/desktop/WES/subscribing-to-events#pull-subscriptions) about the EvtSubscribe method, the Event object passed to EvtSubscribe has been Closed in sample codes.

Is it a bug?

---

<div class="post-metadata">

### Author: ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [December 27, 2018, 2:34pm UTC](https://discuss.elastic.co/t/is-it-a-bug-in-winlogbeat/162011/2 "2018-12-27T14:34:23Z")

</div>

See the conversion in [signalEvent not be closed](https://discuss.elastic.co/t/signalevent-not-be-closed/157966).

I don't recall a pull request being opened to address the issue.

---

<div class="post-metadata">

### Author: ![wenhaochen](https://avatars.discourse-cdn.com/v4/letter/w/898d66/32.png) [@wenhaochen](https://discuss.elastic.co/u/wenhaochen)
#### Post date: [December 31, 2018, 5:29pm UTC](https://discuss.elastic.co/t/is-it-a-bug-in-winlogbeat/162011/3 "2018-12-31T17:29:14Z")

</div>

thanks for ur attention

the PR is posted，

[https://github.com/elastic/beats/pull/9838](https://github.com/elastic/beats/pull/9838)

it‘s a sample one，

and it‘s my first time to post PR to beats，some process might miss

anybody could review it？

thanks

Andrew Kroh [elastic@discoursemail.com](mailto:elastic@discoursemail.com) 于2018年12月27日周四 下午10:44写道：

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 28, 2019, 5:29pm UTC](https://discuss.elastic.co/t/is-it-a-bug-in-winlogbeat/162011/4 "2019-01-28T17:29:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.