Hello, we need to support Win 2003 servers while we migrate the app over to a new stack. Winlogbeat continuously crash on these boxes.
There are 4 app servers. Two are clones of the first one. The fourth was built separately. The latter does not seem to be having the issue. However all three former ones have Winlogbeat service stopping in a few seconds after it was started. They seem to have enough time to deliver some events to the collector (Graylog) and then stop.
After disabling the service an starting the EXE from the command line, I was able to capture the crash output below.
The three cloned servers run Microsoft Windows [Version 5.2.3790]
Config file content is (the same across 5 hosts I have running, two hosts have no issues):
winlogbeat:
# registry_file: C:/ProgramData/winlogbeat/.winlogbeat.yml
event_logs:
- name: Application
ignore_older: 72h
# - name: Security
- name: System
output:
logstash:
hosts: ["logger:5044"]
#
#
#
#logging:
# to_files: true
# files:
# path: C:/ProgramData/winlogbeat/Logs
# rotateeverybytes: 10485760
# level: debug
The output console dump is attached.
Thank you in advance!
C:\Program Files\Elastic\Winlogbeat>winlogbeat.exe -c winlogbeat.yml
Exception 0xc0000005 0x0 0x78 0x7c837f9f
PC=0x7c837f9f
syscall.Syscall9(0x77e4f871, 0x7, 0x2800, 0x33680001, 0x4000102a, 0x0, 0x11d66000, 0x8000, 0x11bb1c30, 0x0, ...)
/usr/local/go/src/runtime/syscall_windows.go:185 +0x4a
github.com/elastic/beats/winlogbeat/sys/eventlogging._FormatMessage(0x2800, 0x33680001, 0x4000102a, 0x0, 0x11d66000, 0x8000, 0x11bb1c30, 0x1, 0x0, 0x0)
/go/src/github.com/elastic/beats/winlogbeat/sys/eventlogging/zsyscall_windows.go:75 +0x97
github.com/elastic/beats/winlogbeat/sys/eventlogging.formatMessage(0x11bb1ba8, 0x2, 0x4000102a, 0x0, 0x11bb1c30, 0x3, 0x3, 0x11d66000, 0x10000, 0x10000, ...)
/go/src/github.com/elastic/beats/winlogbeat/sys/eventlogging/eventlogging_windows.go:210 +0x49a
github.com/elastic/beats/winlogbeat/sys/eventlogging.RenderEvents(0x11ce6000, 0x7ffac, 0x7ffff, 0x0, 0x11d66000, 0x10000, 0x10000, 0x11a67768, 0x0, 0x0, ...)
/go/src/github.com/elastic/beats/winlogbeat/sys/eventlogging/eventlogging_windows.go:155 +0x793
github.com/elastic/beats/winlogbeat/eventlog.(*eventLogging).Read(0x11aea900, 0x0, 0x0, 0x0, 0x0, 0x0)
/go/src/github.com/elastic/beats/winlogbeat/eventlog/eventlogging.go:152 +0x564
github.com/elastic/beats/winlogbeat/beater.(*Winlogbeat).processEventLog(0x11a445d0, 0x11cb8e80, 0xb11100, 0x11aea900, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ...)
/go/src/github.com/elastic/beats/winlogbeat/beater/winlogbeat.go:207 +0x322
created by github.com/elastic/beats/winlogbeat/beater.(*Winlogbeat).Run
/go/src/github.com/elastic/beats/winlogbeat/beater/winlogbeat.go:158 +0x333
goroutine 1 [semacquire]:
sync.runtime_Semacquire(0x11cb8e8c)
/usr/local/go/src/runtime/sema.go:47 +0x26
sync.(*WaitGroup).Wait(0x11cb8e80)
/usr/local/go/src/sync/waitgroup.go:131 +0xa4
github.com/elastic/beats/winlogbeat/beater.(*Winlogbeat).Run(0x11a445d0, 0x11ab0840, 0x0, 0x0)
/go/src/github.com/elastic/beats/winlogbeat/beater/winlogbeat.go:161 +0x35d
github.com/elastic/beats/libbeat/beat.(*Beat).launch(0x11ab0840, 0x95e440, 0x0, 0x0)
/go/src/github.com/elastic/beats/libbeat/beat/beat.go:211 +0x87b
github.com/elastic/beats/libbeat/beat.Run(0x9097bb, 0xa, 0x0, 0x0, 0x95e440, 0x0, 0x0)
/go/src/github.com/elastic/beats/libbeat/beat/beat.go:136 +0x57
main.main()
/go/src/github.com/elastic/beats/winlogbeat/main.go:21 +0x40
goroutine 23 [syscall]:
os/signal.signal_recv(0x0)
/usr/local/go/src/runtime/sigqueue.go:116 +0x11e
os/signal.loop()
/usr/local/go/src/os/signal/signal_unix.go:22 +0x1a
created by os/signal.init.1
/usr/local/go/src/os/signal/signal_unix.go:28 +0x36
goroutine 5 [select]:
github.com/elastic/beats/libbeat/publisher.(*bulkWorker).run(0x11cbb800)
/go/src/github.com/elastic/beats/libbeat/publisher/bulk.go:54 +0x284
created by github.com/elastic/beats/libbeat/publisher.newBulkWorker
/go/src/github.com/elastic/beats/libbeat/publisher/bulk.go:42 +0x1da
goroutine 4 [select]:
github.com/elastic/beats/libbeat/publisher.(*messageWorker).run(0x11a444e0)
/go/src/github.com/elastic/beats/libbeat/publisher/worker.go:63 +0x1c3
created by github.com/elastic/beats/libbeat/publisher.(*messageWorker).init
/go/src/github.com/elastic/beats/libbeat/publisher/worker.go:57 +0xff
goroutine 30 [chan receive]:
github.com/elastic/beats/libbeat/logp.logExpvars(0x11ab08c0)
/go/src/github.com/elastic/beats/libbeat/logp/logp.go:224 +0x15d
created by github.com/elastic/beats/libbeat/logp.Init
/go/src/github.com/elastic/beats/libbeat/logp/logp.go:137 +0x371
goroutine 10 [select]:
github.com/elastic/beats/libbeat/common.(*Cache).StartJanitor.func1(0x11a44720, 0x11a446f0)
/go/src/github.com/elastic/beats/libbeat/common/cache.go:219 +0xd3
created by github.com/elastic/beats/libbeat/common.(*Cache).StartJanitor
/go/src/github.com/elastic/beats/libbeat/common/cache.go:227 +0x8f
...truncated...