fluent / fluent/fluent-plugin-windows-eventlog
Security Channel log -- ErrorCode: 14
- Dominant language
- Ruby
- Stars
- 32
- Forks
- 19
- Avg merge
- 2d 23h
- Merged PRs (30d)
- 1
Description
One of our clients encountered this error. (Sorry that i can't reproduce it in my side.) The client has increased the memory from 8GB to 16 GB and now 32GB. But still it got errorCode:14 which is Out of Memory error code in Windows. Also It affects only Security channel. All other channels' logs flow in without trouble.. I looked through the code and this is the stack-trace that i think it might be happening during the crash(only security channel crashed). I wonder how could one single eventlog entry consumed that much memory considering the client has increased it from 8->16->32GB but still sees the error. Alongside there was always a memory spike when the crash happened
(Note: ordering is in invoking sequence)
- Starting from [subscribe.each](https://github.com/fluent/fluent-plugin-windows-eventlog/blob/master/lib/fluent/plugin/in_windows_eventlog2.rb#L322)
- Then [rb_winevt_subscribe_each](https://github.com/fluent-plugins-nursery/winevt_c/blob/v0.9.1/ext/winevt/winevt_subscribe.c#L465) is invoked by `subscribe.each`
- Then [rb_winevt_subscribe_each_yield](https://github.com/fluent-plugins-nursery/winevt_c/blob/v0.9.1/ext/winevt/winevt_subscribe.c#L471) is invoked
- Then [rb_winevt_subscribe_message](https://github.com/fluent-plugins-nursery/winevt_c/blob/v0.9.1/ext/winevt/winevt_subscribe.c#L446) is invoked
- Then [get_description](https://github.com/fluent-plugins-nursery/winevt_c/blob/ad25519e9ae29bc371e262196d3ba674003fc132/ext/winevt/winevt_subscribe.c#L403) is invoked
- Then [get_message](https://github.com/fluent-plugins-nursery/winevt_c/blob/ad25519e9ae29bc371e262196d3ba674003fc132/ext/winevt/winevt_utils.cpp#L506) is invoked inside `get_description`
- Then [EvtFormatMessage](https://github.com/fluent-plugins-nursery/winevt_c/blob/v0.9.1/ext/winevt/winevt_utils.cpp#L345) is invoked but returns `ERROR_OUTOFMEMORY ` (ErrorCode: 14)
- Finally raise an error [here](https://github.com/fluent-plugins-nursery/winevt_c/blob/v0.9.1/ext/winevt/winevt_utils.cpp#L390)
Error Message:
```2020-12-04 11:07:25 -0800 [warn]: #0 Invalid Hash data on security. error_class=Winevt::EventLog::Query::Error error="ErrorCode: 14"
2020-12-04 11:07:25 -0800 [warn]: #0 C:/Program Files (x86)/Stackdriver/LoggingAgent/Main/lib/ruby/gems/2.6.0/gems/fluent-plugin-windows-eventlog-0.8.0/lib/fluent/plugin/in_windows_eventlog2.rb:322:in `each'
2020-12-04 11:07:25 -0800 [warn]: #0 C:/Program Files (x86)/Stackdriver/LoggingAgent/Main/lib/ruby/gems/2.6.0/gems/fluent-plugin-windows-eventlog-0.8.0/lib/fluent/plugin/in_windows_eventlog2.rb:322:in `on_notify_hash'
2020-12-04 11:07:25 -0800 [warn]: #0 C:/Program Files (x86)/Stackdriver/LoggingAgent/Main/lib/ruby/gems/2.6.0/gems/fluent-plugin-windows-eventlog-0.8.0/lib/fluent/plugin/in_windows_eventlog2.rb:249:in `block (2 levels) in subscribe_channels'
2020-12-04 11:07:25 -0800 [warn]: #0 C:/Program Files (x86)/Stackdriver/LoggingAgent/Main/lib/ruby/gems/2.6.0/gems/fluentd-1.11.2-x86-mingw32/lib/fluent/plugin_helper/timer.rb:80:in `on_timer'
2020-12-04 11:07:25 -0800 [warn]: #0 C:/Program Files (x86)/Stackdriver/LoggingAgent/Main/lib/ruby/gems/2.6.0/gems/cool.io-1.7.0/lib/cool.io/loop.rb:88:in `run_once'
2020-12-04 11:07:25 -0800 [warn]: #0 C:/Program Files (x86)/Stackdriver/LoggingAgent/Main/lib/ruby/gems/2.6.0/gems/cool.io-1.7.0/lib/cool.io/loop.rb:88:in `run'
2020-12-04 11:07:25 -0800 [warn]: #0 C:/Program Files (x86)/Stackdriver/LoggingAgent/Main/lib/ruby/gems/2.6.0/gems/fluentd-1.11.2-x86-mingw32/lib/fluent/plugin_helper/event_loop.rb:93:in `block in start'
2020-12-04 11:07:25 -0800 [warn]: #0 C:/Program Files (x86)/Stackdriver/LoggingAgent/Main/lib/ruby/gems/2.6.0/gems/fluentd-1.11.2-x86-mingw32/lib/fluent/plugin_helper/thread.rb:78:in `block in thread_create'
```
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.