# WinlogBeat stuck @ "Stopping" / Windows-Service

**URL:** <https://discuss.elastic.co/t/winlogbeat-stuck-stopping-windows-service/332879>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [May 9, 2023, 7:07am UTC](https://discuss.elastic.co/t/winlogbeat-stuck-stopping-windows-service/332879 "2023-05-09T07:07:33Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![florianmulatz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/florianmulatz/32/120783_2.png) [@florianmulatz](https://discuss.elastic.co/u/florianmulatz)\
**Post date:** [May 9, 2023, 7:07am UTC](https://discuss.elastic.co/t/winlogbeat-stuck-stopping-windows-service/332879/1 "2023-05-09T07:07:33Z")

</div>

Good Morning guys - please don't blame me if this topic is already covered somewhere - at least I was not able to find it.

I've the problem that my winlogbeat Service (as well as the manually spawned process) never stops if I klick on Stop in Windows-Service-Manager (or press CTRL+C on console).  
I don't know what's happening there - and I even don't know where to start since when I look on the console I can see loglines like

```auto
{"log.level":"info","@timestamp":"2023-05-09T08:55:56.910+0200","log.logger":"service_windows","log.origin":{"file.name":"service/service_windows.go","file.line":63},"message":"received state change 'svc.Stop' from windows service manager","service.name":"winlogbeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2023-05-09T08:55:56.911+0200","log.logger":"service_windows","log.origin":{"file.name":"service/service_windows.go","file.line":74},"message":"changed windows service state to svc.StopPending, invoking stopCallback","service.name":"winlogbeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2023-05-09T08:55:56.915+0200","log.logger":"service","log.origin":{"file.name":"service/service.go","file.line":59},"message":"Received Windows SVC stop/shutdown request","service.name":"winlogbeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2023-05-09T08:55:56.910+0200","log.logger":"service","log.origin":{"file.name":"service/service.go","file.line":52},"message":"Received signal \"interrupt\", stopping","service.name":"winlogbeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2023-05-09T08:55:56.916+0200","log.logger":"winlogbeat","log.origin":{"file.name":"beater/winlogbeat.go","file.line":190},"message":"Stopping Winlogbeat","service.name":"winlogbeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2023-05-09T08:55:56.928+0200","log.logger":"winlogbeat","log.origin":{"file.name":"beater/eventlogger.go","file.line":126},"message":"Stop processing.","service.name":"winlogbeat","id":"Microsoft-Windows-SmbClient/Connectivity","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2023-05-09T08:55:57.009+0200","log.logger":"winlogbeat","log.origin":{"file.name":"beater/eventlogger.go","file.line":126},"message":"Stop processing.","service.name":"winlogbeat","id":"Windows PowerShell","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2023-05-09T08:55:57.236+0200","log.logger":"winlogbeat","log.origin":{"file.name":"beater/eventlogger.go","file.line":126},"message":"Stop processing.","service.name":"winlogbeat","id":"Microsoft-Windows-PowerShell/Operational","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2023-05-09T08:55:57.318+0200","log.logger":"winlogbeat","log.origin":{"file.name":"beater/eventlogger.go","file.line":126},"message":"Stop processing.","service.name":"winlogbeat","id":"Application","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2023-05-09T08:55:57.394+0200","log.logger":"winlogbeat","log.origin":{"file.name":"beater/eventlogger.go","file.line":126},"message":"Stop processing.","service.name":"winlogbeat","id":"Microsoft-Windows-SmbClient/Security","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2023-05-09T08:55:57.394+0200","log.logger":"winlogbeat","log.origin":{"file.name":"beater/eventlogger.go","file.line":126},"message":"Stop processing.","service.name":"winlogbeat","id":"Microsoft-Windows-SMBClient/Operational","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2023-05-09T08:55:57.394+0200","log.logger":"winlogbeat","log.origin":{"file.name":"beater/eventlogger.go","file.line":126},"message":"Stop processing.","service.name":"winlogbeat","id":"Microsoft-Windows-Windows Defender/Operational","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2023-05-09T08:55:57.520+0200","log.logger":"winlogbeat","log.origin":{"file.name":"beater/eventlogger.go","file.line":126},"message":"Stop processing.","service.name":"winlogbeat","id":"Microsoft-Windows-NlaSvc/Operational","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2023-05-09T08:55:57.862+0200","log.logger":"winlogbeat","log.origin":{"file.name":"beater/eventlogger.go","file.line":126},"message":"Stop processing.","service.name":"winlogbeat","id":"Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational","ecs.version":"1.6.0"}

```

I always have to kill the `winlogbeat.exe` from task-manager otherwise I can not start the process again (obviously 🙂 )

Thx for any help guys!

for reference - my winlogbeat.yml (obfuscated)

```auto
winlogbeat.event_logs:
    - name: Application
      ignore_older: 72h
    - name: Security
      ignore_older: 72h
    - name: System
      ignore_older: 72h
    - name: Windows PowerShell
      ignore_older: 72h
    - name: Microsoft-Windows-GroupPolicy/Operational
      ignore_older: 72h
    - name: Microsoft-Windows-SmbClient/Connectivity
      ignore_older: 72h
    - name: Microsoft-Windows-SMBClient/Operational
      ignore_older: 72h
    - name: Microsoft-Windows-SmbClient/Security
      ignore_older: 72h
    - name: Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational
      ignore_older: 72h
    - name: Microsoft-Windows-NlaSvc/Operational
      ignore_older: 72h
    - name: Microsoft-Windows-TaskScheduler/Operational
      ignore_older: 72h
    - name: Microsoft-Windows-PowerShell/Operational
      ignore_older: 72h
    - name: Microsoft-Windows-Windows Defender/Operational
      event_id: 1116
      ignore_older: 72h

output.logstash:
    hosts: ["logstash-output-host1","logstash-output-host2"]
    worker: 1
    loadbalance: true
    slow_start: true

winlogbeat.registry_file: C:/ProgramData/winlogbeat/winlogbeat.yml
 
logging.level: info
logging.to_files: true
logging.to_syslog: false
logging.files:
  path: C:/ProgramData/winlogbeat/Logs
  name: mybeat.log
logging.selectors: ["*"]

```

---

<div class="post-metadata">

**Author:** ![florianmulatz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/florianmulatz/32/120783_2.png) [@florianmulatz](https://discuss.elastic.co/u/florianmulatz)\
**Post date:** [May 11, 2023, 6:40am UTC](https://discuss.elastic.co/t/winlogbeat-stuck-stopping-windows-service/332879/2 "2023-05-11T06:40:08Z")

</div>

any ideas?  
Thx guys

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [May 15, 2023, 11:38pm UTC](https://discuss.elastic.co/t/winlogbeat-stuck-stopping-windows-service/332879/3 "2023-05-15T23:38:44Z")

</div>

It could be this bug.

> <https://github.com/elastic/beats/pull/35474>
>
> \<!-- Type of change
> Please label this PR with one of the following labels, depe…nding on the scope of your change:
> \- Bug
> \- Enhancement
> \- Breaking change
> \- Deprecation
> \- Cleanup
> \- Docs
> \--\>
> 
> \## What does this PR do?
> 
> \<!-- Mandatory
> Explain here the changes you made on the PR. Please explain the WHAT: patterns used, algorithms implemented, design architecture, message processing, etc.
> \--\>
> 
> Currently, if winlogbeat is attempting to open a channel that is not available because it is not found or there is a recoverable error, it will loop and retry. Since signals have been sent to notification handlers by this point, cancellation of the loop is not possible without agreement. So add a cancellation select at the head of the retry loop to allow termination.
> 
> \## Why is it important?
> 
> \<!-- Mandatory
> Explain here the WHY, or the rationale/motivation for the changes.
> \--\>
> 
> The current behaviour requires heroic user intervention when attempting to bring down a running winlogbeat that has not been able to get its input channels.
> 
> \## Checklist
> 
> \<!-- Mandatory
> Add a checklist of things that are required to be reviewed in order to have the PR approved
> 
> List here all the items you have verified BEFORE sending this PR. Please DO NOT remove any item, striking through those that do not apply. (Just in case, strikethrough uses two tildes. ~~Scratch this.~~ )
> \--\>
> 
> \- \[x\] My code follows the style guidelines of this project
> \- \[\] I have commented my code, particularly in hard-to-understand areas
> \- \[\] I have made corresponding changes to the documentation
> \- \[\] I have made corresponding change to the default configuration files
> \- \[\] I have added tests that prove my fix is effective or that my feature works
> \- \[x\] I have added an entry in \`CHANGELOG.next.asciidoc\` or \`CHANGELOG-developer.next.asciidoc\`.
> 
> \## Author's Checklist
> 
> \<!-- Recommended
> Add a checklist of things that are required to be reviewed in order to have the PR approved
> \--\>
> \- \[\]
> 
> \## How to test this PR locally
> 
> \<!-- Recommended
> Explain here how this PR will be tested by the reviewer: commands, dependencies, steps, etc.
> \--\>
> 
> \## Related issues
> 
> \<!-- Recommended
> Link related issues below. Insert the issue link or reference after the word "Closes" if merging this should automatically close it.
> 
> \- Closes #123
> \- Relates #123
> \- Requires #123
> \- Superseds #123
> \--\>
> \- 
> 
> \## Use cases
> 
> \<!-- Recommended
> Explain here the different behaviors that this PR introduces or modifies in this project, user roles, environment configuration, etc.
> 
> If you are familiar with Gherkin test scenarios, we recommend its usage: https://cucumber.io/docs/gherkin/reference/
> \--\>
> 
> \## Screenshots
> 
> \<!-- Optional
> Add here screenshots about how the project will be changed after the PR is applied. They could be related to web pages, terminal, etc, or any other image you consider important to be shared with the team.
> \--\>
> 
> \## Logs
> 
> \<!-- Recommended
> Paste here output logs discovered while creating this PR, such as stack traces or integration logs, or any other output you consider important to be shared with the team.
> \--\>

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 13, 2023, 1:39am UTC](https://discuss.elastic.co/t/winlogbeat-stuck-stopping-windows-service/332879/4 "2023-06-13T01:39:29Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.