search

Graylog2 / collector-sidecar

Manage log collectors through Graylog
https://www.graylog.org/
Other
268 stars 56 forks source link

Beats service won't start on Windows. #404

Closed malcyon closed 3 years ago

malcyon commented 3 years ago

Problem description

When applying a Filebeat or Winlogbeat configuration to a Graylog Sidecar running on Windows, the sidecar throws this error message:

time="2021-03-09T19:38:13Z" level=error msg="[winlogbeat] Unable to validate configuration, timeout reached."

Sometimes, the above error will not occur. The following error will occur instead:

Could not start service: The service did not respond to the start or control request in a timely fashion.

I believe this is due to the Beats version included with #391. I do not see this behavior with Winlogbeat 6.4.2 or 7.11.1.

After I replaced the winlogbeat.exe with the 7.11.1 binary, I was able too see both services start up and messages being published in the log. I was also able to view the events in the Graylog Server UI.

Steps to reproduce the problem

  1. Configure a Graylog Server instance (I used Vagrant and installed via Ansible).
  2. Start up a Windows instance (I used Vagrant for this, too.)
  3. From the Windows machine, download the graylog_sidecar_installer exe from the 1.1 branch on Jenkins.
  4. Install the sidecar, setting the URL and API token to point to your Graylog Server instance.
  5. Configure the Sidecar in the Graylog Server UI and apply a configuration.
  6. Open a command shell in "C:\Program Files\graylog\sidecar" and run ./graylog-sidecar -service install and ./graylog-sidecar -service start.
  7. Open the logfiles in the log dir and see the errors.

Environment

malcyon commented 3 years ago

I tested a few more versions. Below are the results. This was achieved by downloading the Winlogbeat zip file, copying the winlogbeat.exe into the graylog/sidecar directory, stopping/restarting the service, and re-applying the collector config in the UI.

Version Does it work?
6.4.2 :heavy_check_mark:
7.6.2 :x:
7.10.0 :x:
7.10.1 :x:
7.10.2 :x:
7.11.0 :heavy_check_mark:
7.11.1 :heavy_check_mark: