Windows service on Server 2003 does not log to mybeat.log

Elastic Stack Beats
1

Hi, new-ish user here... I am able to get Filebeat 1.2.1 (same effect on 1.1.1) running on a Windows 2003 server from the console, no problem. It reads the logs, writes to its own log files, and places the registry file in the correct location.

However, when I run the service (installed via the powershell script) it APPEARS that the service starts and is processing data (i.e. I set it to debug mode and the CPU starts warming up a bit), and there is the typical network traffic. However, the mybeat.log file is NOT created, and there is no registry file created, as well.

As stated, the console version works fine, configs are fairly simple, but the service appears to start and run without logging or a registry file. I have set these to "normal" locations.

Thanks in advance!!!

Logfile attached:

#############
filebeat:

  prospectors:
    -
      paths:
       - C:\pb\apache-tomcat-7.0.22\logs\xbec_events.log*
       - C:\pb\filebeat/logs\mybeat.log*
       - C:\pb\apache-tomcat-7.0.22\logs\xbec_transactions.log*.log
       - C:\pb\apache-tomcat-7.0.22\logs\catalina.log*

      input_type: log
      scan_frequency: 5s

      harvester_buffer_size: 1024
  spool_size: 1024

  registry_file: "C:/pb/filebeat/registry/registry.file"

output:
  logstash:
    hosts: ["server0:9990", "server1:9990"]


    worker: 1
    loadbalance: true
  ### Console output
#  console:
    # Pretty print json event
    #pretty: false
logging:
  to_files: true
  files:
    path: "c:/pb/filebeat/logs"
    name: mybeat.log
    rotateeverybytes: 10485760 # = 10MB

  level: info
###################
2

Note that the install service script is using the configuration file from the current working directory where the script is execute (assumption is that you execute that in the extracted directory).

I would try to not use the install script, but rather run the commands in it by hand, to make sure they make sense to you, with regards to paths a.s.o.

3

@tudor, I have verified that my directories are correct in the service itself itself i.e. command to run the service inside service controller is
"C:\pb\filebeat\filebeat.exe" -c "C:\pb\filebeat\filebeat.yml"

This issue is we need to deploy this to 200+ servers. If we can't get a service running, this is essentially a no-go, as the server are rebooted fairly often, and logging into it JUST to start Filebeat, is a no-go.

Thanks!

4

Your configuration looks OK to me. Can you check to see if Filebeat has a file handle open to your log file? If you run Sysinternals Process Explorer you can see all the handles a process has open.

It should have a handle open to the log file and there should be something in the file since you have it set to the info level. I ran a quick test with Filebeat running as a windows service using this basic config and took a screenshot.

filebeat-procexp.png967×511 28.6 KB

5

Okay, after much investigation, apparently this is NOT a filebeat issue, nor a service installation issue with filebeat. On our corporate network, permission issues abound.... And I am not in with my admins. Installing it to a "public" directory like "C:\Documents and Settings\All Users\filebeat" worked like a charm.

Now only 199 more nodes to go.

Thanks for the quick replies!!!