signalEvent not be closed


(Chen Wenhao) #1

Hi,

  1. code from https://github.com/elastic/beats/blob/master/winlogbeat/eventlog/wineventlog.go#L125
    signalEvent not be closed, handle leak might happen when calling Open()func many times ?

  2. and one more thing confuse me:
    Pull Subscriptions example as below( https://docs.microsoft.com/zh-cn/windows/desktop/WES/subscribing-to-events)

 <... more ...>
 aWaitHandles[1] = CreateEvent(NULL, TRUE, TRUE, NULL);
 <... more ...>

    // Subscribe to events.
    hSubscription = EvtSubscribe(NULL, aWaitHandles[1], pwsPath, pwsQuery, NULL, NULL, NULL, EvtSubscribeStartAtOldestRecord);

// Loop until the user presses a key or there is an error.
while (true)
{
    dwWait = WaitForMultipleObjects(sizeof(aWaitHandles)/sizeof(HANDLE), aWaitHandles, FALSE, INFINITE);

    if (0 == dwWait - WAIT_OBJECT_0)  // Console input
    {
        if (IsKeyEvent(aWaitHandles[0]))
            break;
    }
    else if (1 == dwWait - WAIT_OBJECT_0) // Query results
    {
        if (ERROR_NO_MORE_ITEMS != (status = EnumerateResults(hSubscription)))
        {
            break;
        }

        ResetEvent(aWaitHandles[1]);
    }
<... more ... >
}

compared to winlogbeat codes


seems we do not use signalEvent as aWaitHandles[1]) do

thanks


(Andrew Kroh) #2

I think Open() is only called once for each event log so we haven’t observed any leaks. But it does look like the Close() method should be updated to all close the handle returned by CreateEvent.


(Chen Wenhao) #3

In my case, if error happens, I'll call Open()to recreate new eventlog instance , then handle leaks observed when some error in my env;

It does hard to lead to leaks if called once, but still might cause issue sometime
do u think should I post any fix code?

thanks


(Andrew Kroh) #4

We might as well fix it, so yes, please.


(Chen Wenhao) #5

one more:


why return nil when err happens
thanks