### Author:  [@wenhaochen](https://discuss.elastic.co/u/wenhaochen)
#### Post date: [November 23, 2018, 7:25am UTC](https://discuss.elastic.co/t/signalevent-not-be-closed/157966/1 "2018-11-23T07:25:59Z")
Hi，
1. code from [https://github.com/elastic/beats/blob/master/winlogbeat/eventlog/wineventlog.go#L125](https://github.com/elastic/beats/blob/master/winlogbeat/eventlog/wineventlog.go#L125)
signalEvent not be closed, handle leak might happen when calling `Open()`func many times ?
2. and one more thing confuse me:
Pull Subscriptions example as below( [https://docs.microsoft.com/zh-cn/windows/desktop/WES/subscribing-to-events](https://docs.microsoft.com/zh-cn/windows/desktop/WES/subscribing-to-events))
```auto
<... more ...>
aWaitHandles[1] = CreateEvent(NULL, TRUE, TRUE, NULL);
<... more ...>
// Subscribe to events.
hSubscription = EvtSubscribe(NULL, aWaitHandles[1], pwsPath, pwsQuery, NULL, NULL, NULL, EvtSubscribeStartAtOldestRecord);
// Loop until the user presses a key or there is an error.
while (true)
{
dwWait = WaitForMultipleObjects(sizeof(aWaitHandles)/sizeof(HANDLE), aWaitHandles, FALSE, INFINITE);
if (0 == dwWait - WAIT_OBJECT_0) // Console input
{
if (IsKeyEvent(aWaitHandles[0]))
break;
}
else if (1 == dwWait - WAIT_OBJECT_0) // Query results
{
if (ERROR_NO_MORE_ITEMS != (status = EnumerateResults(hSubscription)))
{
break;
}
ResetEvent(aWaitHandles[1]);
}
<... more ... >
}
```
compared to winlogbeat codes
>
seems we do not use signalEvent as `aWaitHandles[1])` do
thanks
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [November 25, 2018, 10:56pm UTC](https://discuss.elastic.co/t/signalevent-not-be-closed/157966/2 "2018-11-25T22:56:03Z")
I think `Open()` is only called once for each event log so we haven’t observed any leaks. But it does look like the `Close()` method should be updated to all close the handle returned by `CreateEvent`.
---
### Author:  [@wenhaochen](https://discuss.elastic.co/u/wenhaochen)
#### Post date: [November 28, 2018, 2:44am UTC](https://discuss.elastic.co/t/signalevent-not-be-closed/157966/3 "2018-11-28T02:44:33Z")
In my case, if error happens, I'll call `Open()`to recreate new eventlog instance , then handle leaks observed when some error in my env;
It does hard to lead to leaks if called once, but still might cause issue sometime
do u think should I post any fix code?
thanks
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [November 28, 2018, 4:07am UTC](https://discuss.elastic.co/t/signalevent-not-be-closed/157966/4 "2018-11-28T04:07:24Z")
We might as well fix it, so yes, please.
---
### Author:  [@wenhaochen](https://discuss.elastic.co/u/wenhaochen)
#### Post date: [November 30, 2018, 3:01am UTC](https://discuss.elastic.co/t/signalevent-not-be-closed/157966/5 "2018-11-30T03:01:13Z")
one more:
>
why return nil when err happens
thanks
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 28, 2018, 3:01am UTC](https://discuss.elastic.co/t/signalevent-not-be-closed/157966/6 "2018-12-28T03:01:18Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.