Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(inputs.win_eventlog): Handle remote events more robustly. #12375

Merged
merged 9 commits into from
Jan 10, 2023

Conversation

srebhan
Copy link
Contributor

@srebhan srebhan commented Dec 12, 2022

resolves #12328

This PR fixes a panic in inputs.win_eventlog for cases where events are sent by a remote machine (i.e. via Windows-event-forwarding) which is unavailable at the time Telegraf gathers those events. The root cause is that Windows' EvtFormatMessage syscall is expecting a handle to the publisher (i.e. the machine that sent the event) which is becoming invalid if that publisher is down. As a consequence Windows throws an exception (read Golang panic) instead of returning a simple error.

The implemented approach is to completely avoid the EvtFormatMessage syscall for remote events and instead use the RenderingInfo attached to the event itself (only existing for remote events).

@telegraf-tiger telegraf-tiger bot added fix pr to fix corresponding bug plugin/input 1. Request for new input plugins 2. Issues/PRs that are related to input plugins labels Dec 12, 2022
@srebhan srebhan changed the title fix(inputs.win_eventlog): Handle empty log elements. fix(inputs.win_eventlog): Handle remote events more robustly. Jan 9, 2023
@srebhan srebhan added platform/windows area/windows Related to windows plugins (win_eventlog, win_perf_counters, win_services) labels Jan 9, 2023
@srebhan srebhan added the ready for final review This pull request has been reviewed and/or tested by multiple users and is ready for a final review. label Jan 9, 2023
Copy link
Contributor

@powersj powersj left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Merge once debug statement is removed!

@telegraf-tiger
Copy link
Contributor

@srebhan srebhan merged commit 7b5b342 into influxdata:master Jan 10, 2023
@srebhan srebhan deleted the win_eventlog_issue_12328 branch January 10, 2023 10:06
srebhan added a commit that referenced this pull request Jan 30, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
area/windows Related to windows plugins (win_eventlog, win_perf_counters, win_services) fix pr to fix corresponding bug platform/windows plugin/input 1. Request for new input plugins 2. Issues/PRs that are related to input plugins ready for final review This pull request has been reviewed and/or tested by multiple users and is ready for a final review.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Telegraf crashes with an exception for inputs.win_eventlog
2 participants