# Winlogbeat v5 fail to start after upgrade **URL:** \ **Category:** Beats\ **Tags:** winlogbeat\ **Created:** [April 15, 2016, 8:46am UTC](https://discuss.elastic.co/t/winlogbeat-v5-fail-to-start-after-upgrade/47483 "2016-04-15T08:46:23Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![tuankun](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tuankun/32/8590_2.png) [@tuankun](https://discuss.elastic.co/u/tuankun)\ **Post date:** [April 15, 2016, 8:46am UTC](https://discuss.elastic.co/t/winlogbeat-v5-fail-to-start-after-upgrade/47483/1 "2016-04-15T08:46:23Z")
Hi Sir, I installed winlogbeat 1.1.2 on windows server 2012 R2, since it could not generate event\_data field ,I uninstalled the winlogbeat service using uninstall-service-winlogbeat.ps1,and replaced it with winlogbeat v5 ,but when I ran the winlogbeat in the command window,it failed to start: ![](https://us1.discourse-cdn.com/elastic/original/2X/7/732cb65810b2e4219a7eb1d101cf63132390b407.png) then I tried to register winlogbeat using powershell and started it,also failed: ![](https://us1.discourse-cdn.com/elastic/original/2X/f/f0c64c41d869409d4adfb41e4645b8c8bde32dd1.png) I don't know why,anyone could help me? thank you so much. ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [April 15, 2016, 1:53pm UTC](https://discuss.elastic.co/t/winlogbeat-v5-fail-to-start-after-upgrade/47483/2 "2016-04-15T13:53:09Z")
> [@tuankun](#): > > yaml: control characters are not allowed It looks like there is an issue with the contents of your winlogbeat.yml configuration file. Is there anymore to the error message? Maybe restart from a clean configuration file. Make sure there are no tabs in it. ---
**Author:** ![tuankun](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tuankun/32/8590_2.png) [@tuankun](https://discuss.elastic.co/u/tuankun)\ **Post date:** [April 16, 2016, 2:10am UTC](https://discuss.elastic.co/t/winlogbeat-v5-fail-to-start-after-upgrade/47483/3 "2016-04-16T02:10:31Z")
Hi Andrew, I redownload the winlogbeat-5.0.0-alpha1-windows-64.zip from [elastic.co](http://elastic.co),and just disable the elasticsearch output section using "#" ,enable logstash section and modify the logstash destination IP and port, run again,also failed: ![](https://us1.discourse-cdn.com/elastic/original/2X/0/060a1a59bc2697f9fa9216e899d1a3973b5a493e.png) "C:\ProgramData\winlogbeat\Logs\winlogbeat" log file shows: _2016-04-16T09:37:44+08:00 INFO State will be read from and persisted to C:\ProgramData\winlogbeat.winlogbeat.yml_ _2016-04-16T09:37:44+08:00 INFO Setup Beat: winlogbeat; Version: 5.0.0-alpha1_ _2016-04-16T09:37:44+08:00 INFO GeoIP disabled: No paths were set under shipper.geoip.paths_ _2016-04-16T09:37:44+08:00 INFO Max Retries set to: 3_ _2016-04-16T09:37:44+08:00 INFO Activated logstash as output plugin._ _2016-04-16T09:37:44+08:00 INFO Publisher name: SFCDC01_ _2016-04-16T09:37:44+08:00 INFO Flush Interval set to: 1s_ _2016-04-16T09:37:44+08:00 INFO Max Bulk Size set to: 2048_ _2016-04-16T09:37:44+08:00 INFO winlogbeat cleanup_ _2016-04-16T09:37:44+08:00 INFO Dumping runtime metrics..._ _2016-04-16T09:37:44+08:00 INFO cmdline=["winlogbeat.exe"]_ _2016-04-16T09:37:44+08:00 INFO dropReasons={}_ _2016-04-16T09:37:44+08:00 INFO ignoredEvents={}_ _2016-04-16T09:37:44+08:00 INFO libbeatEsPublishEventsCallCount=0_ _2016-04-16T09:37:44+08:00 INFO libbeatEsPublishedAndAckedEvents=0_ _2016-04-16T09:37:44+08:00 INFO libbeatEsPublishedButNotAckedEvents=0_ _2016-04-16T09:37:44+08:00 INFO libbeatKafkaPublishEventsCallCount=0_ _2016-04-16T09:37:44+08:00 INFO libbeatKafkaPublishedAndAckedEvents=0_ _2016-04-16T09:37:44+08:00 INFO libbeatKafkaPublishedButNotAckedEvents=0_ _2016-04-16T09:37:44+08:00 INFO libbeatLogstashPublishEventsCallCount=0_ _2016-04-16T09:37:44+08:00 INFO libbeatLogstashPublishedAndAckedEvents=0_ _2016-04-16T09:37:44+08:00 INFO libbeatLogstashPublishedButNotAckedEvents=0_ _2016-04-16T09:37:44+08:00 INFO libbeatMessagesDropped=0_ _2016-04-16T09:37:44+08:00 INFO libbeatMessagesInWorkerQueues=0_ _2016-04-16T09:37:44+08:00 INFO libbeatPublishedEvents=0_ _2016-04-16T09:37:44+08:00 INFO msgFileCacheStats={}_ _2016-04-16T09:37:44+08:00 INFO publishedEvents={}_ _2016-04-16T09:37:44+08:00 INFO uptime={"server\_time":"2016-04-16T01:37:44.2401025Z","start\_time":"2016-04-16T01:37:44.1151009Z","uptime":"125.0016ms","uptime\_ms":"125001"}_ _2016-04-16T09:37:44+08:00 CRIT Exiting: yaml: control characters are not allowed_ how can I send the winlogbeat.yml to you for advanced analysis? thank you so much . ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [April 16, 2016, 2:41am UTC](https://discuss.elastic.co/t/winlogbeat-v5-fail-to-start-after-upgrade/47483/4 "2016-04-16T02:41:06Z")
Please post your config file here or post a [http://pastebin.com](http://pastebin.com) link to it. ---
**Author:** ![tuankun](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tuankun/32/8590_2.png) [@tuankun](https://discuss.elastic.co/u/tuankun)\ **Post date:** [April 16, 2016, 2:59am UTC](https://discuss.elastic.co/t/winlogbeat-v5-fail-to-start-after-upgrade/47483/5 "2016-04-16T02:59:30Z")
@andrewkroh Hi Andrew, the winlogbeat.yml as follows: [http://pastebin.com/kmLjzQU7](http://pastebin.com/kmLjzQU7) ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [April 20, 2016, 2:40am UTC](https://discuss.elastic.co/t/winlogbeat-v5-fail-to-start-after-upgrade/47483/6 "2016-04-20T02:40:48Z")
I didn't find any issues with the config you posted. Maybe the invalid characters were lost in the copy/paste to pastebin. Try creating a new minimal configuration file using the configuration from the [Getting Started guide](https://www.elastic.co/guide/en/beats/winlogbeat/master/winlogbeat-configuration.html) as your starting point. ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [April 20, 2016, 3:01am UTC](https://discuss.elastic.co/t/winlogbeat-v5-fail-to-start-after-upgrade/47483/7 "2016-04-20T03:01:18Z")
While looking more closely at the log message you posted, I suspect the error is actually related to your registry file and not your config. Look at your registry file. ---
**Author:** ![tuankun](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tuankun/32/8590_2.png) [@tuankun](https://discuss.elastic.co/u/tuankun)\ **Post date:** [April 20, 2016, 3:28am UTC](https://discuss.elastic.co/t/winlogbeat-v5-fail-to-start-after-upgrade/47483/8 "2016-04-20T03:28:52Z")
@andrewkroh Great!!!😀 I delete C:\ProgramData\winlogbeat,and successfully to start winlogbeat. thank you so so much~ ---
**Author:** ![rgleonard](https://avatars.discourse-cdn.com/v4/letter/r/65b543/32.png) [@rgleonard](https://discuss.elastic.co/u/rgleonard)\ **Post date:** [April 30, 2016, 1:40am UTC](https://discuss.elastic.co/t/winlogbeat-v5-fail-to-start-after-upgrade/47483/9 "2016-04-30T01:40:07Z")
We have multiple clients installed have noticed nearly each time the service is not allowed or capable of a graceful shutdown (Power failure, system crash, etc) it seems to corrupt the registry file and requires it be deleted to allow the service to start up again afterwards. ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [April 30, 2016, 3:44pm UTC](https://discuss.elastic.co/t/winlogbeat-v5-fail-to-start-after-upgrade/47483/10 "2016-04-30T15:44:58Z")
I haven't seen this myself yet. Are you able to reliably reproduce the behavior? Having debug logs from the process would be helpful so we could see what it was doing when the system stopped/crashed. And also having the corrupt file would be useful too. Maybe we can get some clues from it. While the process is running it periodically flushes its state to disk if there were changes to the internal state. It does this after 10 updates or after 5 seconds, whichever comes first. It writes the state information to `.winlogbeat.yml.new`, closes the file, then moves it to `.winlogbeat.yml`. In this way, if the process dies while writing to the file it shouldn't corrupt the `.winlogbeat.yml` file. It would have to die while in the [`MoveFileEx`](https://msdn.microsoft.com/en-us/library/windows/desktop/aa365240%28v=vs.85%29.aspx?f=255&MSPPError=-2147217396) system call to cause problems (but hopefully the move operation is atomic in the filesystem). On shutdown it performs one final flush to disk if there are any changes that had not been written. ---
**Author:** ![rgleonard](https://avatars.discourse-cdn.com/v4/letter/r/65b543/32.png) [@rgleonard](https://discuss.elastic.co/u/rgleonard)\ **Post date:** [May 3, 2016, 12:35pm UTC](https://discuss.elastic.co/t/winlogbeat-v5-fail-to-start-after-upgrade/47483/11 "2016-05-03T12:35:52Z")
Sadly, no we don’t have a way to reproduce it reliably per say and we ended up doing a mass delete of the reg files to get things going. Short version, one of our buildings is under construction that building received multiple power blips over the last few weeks. Each time, systems not on a UPS exhibited the same behavior. During our troubleshooting I did snag a copy of the reg file (attached here). In case it doesn’t make it through, numerous (~580) “NUL” chars were written to the file rendering the service incapable of starting returning only the “control characters are not allowed” message. -Rob ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 24, 2016, 12:35pm UTC](https://discuss.elastic.co/t/winlogbeat-v5-fail-to-start-after-upgrade/47483/12 "2016-05-24T12:35:54Z")
This topic was automatically closed 21 days after the last reply. New replies are no longer allowed. ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [September 1, 2016, 8:50pm UTC](https://discuss.elastic.co/t/winlogbeat-v5-fail-to-start-after-upgrade/47483/13 "2016-09-01T20:50:41Z")
---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [September 1, 2016, 9:06pm UTC](https://discuss.elastic.co/t/winlogbeat-v5-fail-to-start-after-upgrade/47483/14 "2016-09-01T21:06:27Z")
@rgleonard I think I tracked down the cause of this issue and have a fix prepared for it. The details are in [https://github.com/elastic/beats/issues/2313#issuecomment-244211872](https://github.com/elastic/beats/issues/2313#issuecomment-244211872) (spoiler alert: it's the file system cache). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 5, 2017, 9:50pm UTC](https://discuss.elastic.co/t/winlogbeat-v5-fail-to-start-after-upgrade/47483/15 "2017-07-05T21:50:40Z")