Winlogbeat failed to start

Elastic Stack Beats
1

Hi there,
I'm trying to install winlogbeat 5.6.4 x64 on windows server 2012,but failed to start it,error as follows:

PS C:\winlogbeat-5.6.4> Start-Service -DisplayName “winlogbeat” -Verbose
VERBOSE: Performing the operation "Start-Service" on target "winlogbeat (winlogbeat)".
Start-Service : Service 'winlogbeat (winlogbeat)' cannot be started due to the following error: Cannot start service
winlogbeat on computer '.'.
At line:1 char:1

  • Start-Service -DisplayName “winlogbeat” -Verbose
  •   + CategoryInfo          : OpenError: (System.ServiceProcess.ServiceController:ServiceController) [Start-Service],
 ServiceCommandException
  + FullyQualifiedErrorId : CouldNotStartService,Microsoft.PowerShell.Commands.StartServiceCommand

I also tested yml file,and it's normal:

PS C:\winlogbeat-5.6.4> .\winlogbeat.exe -c .\winlogbeat.yml -configtest -e
2017/12/01 05:25:27.844099 beat.go:297: INFO Home path: [C:\winlogbeat-5.6.4] Config path: [C:\winlogbeat-5.6.4] Data pa
th: [C:\winlogbeat-5.6.4\data] Logs path: [C:\winlogbeat-5.6.4\logs]
2017/12/01 05:25:27.845095 beat.go:192: INFO Setup Beat: winlogbeat; Version: 5.6.4
2017/12/01 05:25:27.844099 metrics.go:23: INFO Metrics logging every 30s
2017/12/01 05:25:27.845095 logstash.go:91: INFO Max Retries set to: 3
2017/12/01 05:25:27.845095 outputs.go:108: INFO Activated logstash as output plugin.
2017/12/01 05:25:27.845095 publish.go:300: INFO Publisher name: CNKUSALLIEIAS04
2017/12/01 05:25:27.849100 async.go:63: INFO Flush Interval set to: 1s
2017/12/01 05:25:27.849100 async.go:64: INFO Max Bulk Size set to: 2048
2017/12/01 05:25:27.849100 winlogbeat.go:71: INFO State will be read from and persisted to C:\winlogbeat-5.6.4\data.winlogbeat.yml
Config OK

and I tried to execute .\winlogbeat.exe -c winlogbeat.yml -e -v -d "*", also it's successfully to transfer wineventlog to es.

is there any issue with windows server 2012? and how to fix it? really thanks.

2

Can you try starting the PowerShell console with elevated privileges (as administrator)?

3

Cool! Note action point 4.
Steps as per here: https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-installation.html

4

yes,I've tried it(starting the PowerShell console with elevated privileges (as administrator)) several time,but still not work.

5

Can you start the service manually per services mmc? Can you get the service with Get-Service winlogbeat?

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.