fluent / fluent/fluent-plugin-windows-eventlog

Security Channel log -- ErrorCode: 14

Open
#73 7 comments 0 reactions 0 assignees View on GitHub
question
Dominant language
Ruby
Stars
32
Forks
19
Avg merge
2d 23h
Merged PRs (30d)
1

Description

One of our clients encountered this error. (Sorry that i can't reproduce it in my side.) The client has increased the memory from 8GB to 16 GB and now 32GB. But still it got errorCode:14 which is Out of Memory error code in Windows. Also It affects only Security channel. All other channels' logs flow in without trouble.. I looked through the code and this is the stack-trace that i think it might be happening during the crash(only security channel crashed). I wonder how could one single eventlog entry consumed that much memory considering the client has increased it from 8->16->32GB but still sees the error. Alongside there was always a memory spike when the crash happened

(Note: ordering is in invoking sequence)

- Starting from [subscribe.each](https://github.com/fluent/fluent-plugin-windows-eventlog/blob/master/lib/fluent/plugin/in_windows_eventlog2.rb#L322)

- Then [rb_winevt_subscribe_each](https://github.com/fluent-plugins-nursery/winevt_c/blob/v0.9.1/ext/winevt/winevt_subscribe.c#L465) is invoked by `subscribe.each`

- Then [rb_winevt_subscribe_each_yield](https://github.com/fluent-plugins-nursery/winevt_c/blob/v0.9.1/ext/winevt/winevt_subscribe.c#L471) is invoked

- Then [rb_winevt_subscribe_message](https://github.com/fluent-plugins-nursery/winevt_c/blob/v0.9.1/ext/winevt/winevt_subscribe.c#L446) is invoked

- Then [get_description](https://github.com/fluent-plugins-nursery/winevt_c/blob/ad25519e9ae29bc371e262196d3ba674003fc132/ext/winevt/winevt_subscribe.c#L403) is invoked

- Then [get_message](https://github.com/fluent-plugins-nursery/winevt_c/blob/ad25519e9ae29bc371e262196d3ba674003fc132/ext/winevt/winevt_utils.cpp#L506) is invoked inside `get_description`

- Then [EvtFormatMessage](https://github.com/fluent-plugins-nursery/winevt_c/blob/v0.9.1/ext/winevt/winevt_utils.cpp#L345) is invoked but returns `ERROR_OUTOFMEMORY ` (ErrorCode: 14)

- Finally raise an error [here](https://github.com/fluent-plugins-nursery/winevt_c/blob/v0.9.1/ext/winevt/winevt_utils.cpp#L390)

Error Message:
```2020-12-04 11:07:25 -0800 [warn]: #0 Invalid Hash data on security. error_class=Winevt::EventLog::Query::Error error="ErrorCode: 14"
2020-12-04 11:07:25 -0800 [warn]: #0 C:/Program Files (x86)/Stackdriver/LoggingAgent/Main/lib/ruby/gems/2.6.0/gems/fluent-plugin-windows-eventlog-0.8.0/lib/fluent/plugin/in_windows_eventlog2.rb:322:in `each'
2020-12-04 11:07:25 -0800 [warn]: #0 C:/Program Files (x86)/Stackdriver/LoggingAgent/Main/lib/ruby/gems/2.6.0/gems/fluent-plugin-windows-eventlog-0.8.0/lib/fluent/plugin/in_windows_eventlog2.rb:322:in `on_notify_hash'
2020-12-04 11:07:25 -0800 [warn]: #0 C:/Program Files (x86)/Stackdriver/LoggingAgent/Main/lib/ruby/gems/2.6.0/gems/fluent-plugin-windows-eventlog-0.8.0/lib/fluent/plugin/in_windows_eventlog2.rb:249:in `block (2 levels) in subscribe_channels'
2020-12-04 11:07:25 -0800 [warn]: #0 C:/Program Files (x86)/Stackdriver/LoggingAgent/Main/lib/ruby/gems/2.6.0/gems/fluentd-1.11.2-x86-mingw32/lib/fluent/plugin_helper/timer.rb:80:in `on_timer'
2020-12-04 11:07:25 -0800 [warn]: #0 C:/Program Files (x86)/Stackdriver/LoggingAgent/Main/lib/ruby/gems/2.6.0/gems/cool.io-1.7.0/lib/cool.io/loop.rb:88:in `run_once'
2020-12-04 11:07:25 -0800 [warn]: #0 C:/Program Files (x86)/Stackdriver/LoggingAgent/Main/lib/ruby/gems/2.6.0/gems/cool.io-1.7.0/lib/cool.io/loop.rb:88:in `run'
2020-12-04 11:07:25 -0800 [warn]: #0 C:/Program Files (x86)/Stackdriver/LoggingAgent/Main/lib/ruby/gems/2.6.0/gems/fluentd-1.11.2-x86-mingw32/lib/fluent/plugin_helper/event_loop.rb:93:in `block in start'
2020-12-04 11:07:25 -0800 [warn]: #0 C:/Program Files (x86)/Stackdriver/LoggingAgent/Main/lib/ruby/gems/2.6.0/gems/fluentd-1.11.2-x86-mingw32/lib/fluent/plugin_helper/thread.rb:78:in `block in thread_create'
```

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.