fluent / fluent/fluent-plugin-windows-eventlog
Issue with remote event subscription
- Dominant language
- Ruby
- Stars
- 32
- Forks
- 19
- Avg merge
- 2d 23h
- Merged PRs (30d)
- 1
Description
Hi,
I'm trying to write a config that queries a remote server for Windows Events. My config looks like this:
```
@type windows_eventlog2
@id windows_remote
@log_level trace
read_existing_events false
read_interval 2
tag winevt.remote
rate_limit 200
@type local
persistent true
path C:\opt\td-agent\winevt-remote.pos
channels ["System"]
read_existing_events false
read_all_channels true
remote_server web-01.
remote_domain
remote_username Administrator
remote_password
@type stdout
```
And it seems as if no remote events are ever fetched. Instead, it seems to be getting local events for some reason, as per the following output from running this locally (the dc is the local machine running this in my testing environment):
```
2020-11-09 18:04:47 +0000 [info]: fluent/log.rb:327:info: starting fluentd-1.11.2 pid=5592 ruby="2.7.1"
2020-11-09 18:04:47 +0000 [info]: fluent/log.rb:327:info: spawn command to main: cmdline=["C:/opt/td-agent/bin/ruby.exe", "-Eascii-8bit:ascii-8bit", "C:/opt/td-agent/bin/fluentd", "-c", "etc\\td-agent\\td-agent.conf", "-v", "--under-supervisor"]
2020-11-09 18:04:55 +0000 [info]: fluent/log.rb:327:info: adding match pattern="winevt.remote" type="stdout"
2020-11-09 18:04:55 +0000 [info]: fluent/log.rb:327:info: adding source type="windows_eventlog2"
2020-11-09 18:04:57 +0000 [debug]: #0 fluent/log.rb:306:debug: No fluent logger for internal event
2020-11-09 18:04:57 +0000 [warn]: fluent/log.rb:348:warn: parameter 'remote_server' in
channels ["System"]
read_existing_events false
remote_server web-01.
remote_domain
remote_username Administrator
remote_password
is not used.
2020-11-09 18:04:57 +0000 [warn]: fluent/log.rb:348:warn: parameter 'remote_domain' in
channels ["System"]
read_existing_events false
remote_server web-01.
remote_domain
remote_username Administrator
remote_password
is not used.
2020-11-09 18:04:57 +0000 [warn]: fluent/log.rb:348:warn: parameter 'remote_username' in
channels ["System"]
read_existing_events false
remote_server web-01.
remote_domain
remote_username Administrator
remote_password
is not used.
2020-11-09 18:04:57 +0000 [warn]: fluent/log.rb:348:warn: parameter 'remote_password' in
channels ["System"]
read_existing_events false
remote_server web-01.
remote_domain
remote_username Administrator
remote_password
is not used.
2020-11-09 18:04:57 +0000 [info]: #0 fluent/log.rb:327:info: starting fluentd worker pid=6612 ppid=5592 worker=0
2020-11-09 18:04:57 +0000 [info]: #0 fluent/log.rb:327:info: fluentd worker is now running worker=0
2020-11-09 18:05:09.089322800 +0000 winevt.remote: {"ProviderName":"Service Control Manager","ProviderGUID":"","EventID":"1073748860","Level":"4","Task":"0","Opcode":"0","Keywords":"0x8080000000000000","TimeCreated":"2020/11/09 18:05:06.614689300","EventRecordID":"65701","ActivityID":"","RelatedActivityID":"","ProcessID":"600","ThreadID":"7648","Channel":"System","Computer":"DC.","UserID":"","Version":"0","Description":"The Print Spooler service entered the stopped state.","EventData":["Print Spooler","stopped","?"]}
2020-11-09 18:05:09.094874500 +0000 winevt.remote: {"ProviderName":"Service Control Manager","ProviderGUID":"","EventID":"1073748860","Level":"4","Task":"0","Opcode":"0","Keywords":"0x8080000000000000","TimeCreated":"2020/11/09 18:05:07.937694400","EventRecordID":"65702","ActivityID":"","RelatedActivityID":"","ProcessID":"600","ThreadID":"7648","Channel":"System","Computer":"DC.","UserID":"","Version":"0","Description":"The Print Spooler service entered the running state.","EventData":["Print Spooler","running","?"]}
```
Any advice as to how to proceed in troubleshooting this? I am not sure what those "parameter is not used" - maybe I have misconfigured something?
Contributor guide
No contributing guide indexed for this repository
Research direction
No source files or tests are named in the report. Start at the windows_eventlog2 source and its configuration handling, then trace the "parameter ... is not used" warnings and remote subscription path; done means the cause of local rather than remote event collection is identified and a reproducible configuration or fix is documented.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- ruby
- Domain
- observability-sre
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100