WMI plugin query error: IEnumVARIANT::Next (memory leak?)

(Daniel) #1

Hello, not sure if this is the right place for plugin support but I've encountered a possible memory leak or something that blocks the processing of WMI queries.

I've setup my LogStash config on 5 different machines all pointing to one ElasticSearch database.

For every machine, I encountered this error after 2-3 hours of running LogStash:
WMI query error: IEnumVARIANT::Next
And this is displayed many times over. From Kibana, I also see that there is no data coming into ElasticSearch after this error occurs.

I don't think my config file is the cause but here is one of my typical WMI inputs as an example:
wmi {
type => "WMI"
tags => "PercentProcessorTime"
query => "select PercentProcessorTime from Win32_PerfFormattedData_PerfProc_Process where name = ''"

I have about 8 of these.

Has anyone else had trouble with the WMI plugin or can think of any solutions?

Note: This person here has encountered the exact same thing except I run on Windows 7. https://github.com/elastic/logstash/issues/2555

(Joost Van den Cruyce) #2

I currently have exactly the same problem with similar WMI queries (logstash v1.5.1). Is there already any root cause identified or a known workaround? Running logstash on MS server 2012.

Thanks in advance for any advise!

(system) #3