logstash
  1. logstash
  2. LOGSTASH-605

Logstash Agent win32ole error on Windows

    Details

    • Type: Bug/Feature Bug/Feature
    • Status: Confirmed (View Workflow)
    • Resolution: Fixed
    • Affects Version/s: 1.1.12
    • Fix Version/s: None
    • Labels:

      Description

      Similar issue to that mentioned in logstash-users() 21 July 2012
      http://comments.gmane.org/gmane.comp.sysutils.logstash.user/986

      Known to occur in Windows 6.0.6002 (Windows Server 2008 Standard SP2)
      Java SE 1.7.0_07 64 bit and
      Java SE 1.6.0_20 32 bit
      Logstash 1.1.1

      Problem :

      Logstash launches fine, as long as I do not use the eventlog input type.

      If the eventlog input type is used, ie :

      input {
      eventlog

      { type => "Windows-Eventlog" name => "System" }

      }

      Then logstash will not start due to jruby errors in Java. Problem occurs in both 32 and 64 bit java, but the error reference "racob-*.dll" points to a different version depending.

      !!!! Missing jruby-win32ole gem: jruby -S gem install jruby-win32ole
      LoadError: load error: win32ole/win32ole – java.lang.UnsatisfiedLinkError: Expecting an absolute path of the library: file:C:/logstash/logstash.jar!/gems/jruby-win32ole-0.8.5/lib/racob-x64.dll
      require at org/jruby/RubyKernel.java:1042
      require at file:/C:/logstash/logstash.jar!/META-INF/jruby.home/lib/ruby/site_ruby/1.8/rubygems/custom_require.rb:36
      (root) at file:C:/logstash/logstash.jar!/gems/jruby-win32ole-0.8.5/lib/jruby-win32ole.rb:10
      require at org/jruby/RubyKernel.java:1042
      require at file:/C:/logstash/logstash.jar!/META-INF/jruby.home/lib/ruby/site_ruby/1.8/rubygems/custom_require.rb:36
      (root) at file:C:/logstash/logstash.jar!/gems/jruby-win32ole-0.8.5/lib/jruby-win32ole.rb:3
      require at org/jruby/RubyKernel.java:1042
      require at file:/C:/logstash/logstash.jar!/META-INF/jruby.home/lib/ruby/site_ruby/1.8/rubygems/custom_require.rb:36
      register at file:/C:/logstash/logstash.jar!/META-INF/jruby.home/lib/ruby/site_ruby/shared/jruby/win32ole/stub.rb:32
      run_input at file:/C:/logstash/logstash.jar!/logstash/agent.rb:677
      run_input at file:/C:/logstash/logstash.jar!/logstash/agent.rb:677
      start_input at file:/C:/logstash/logstash.jar!/logstash/agent.rb:350

      I have gone as far as to install Jruby on this server, to extract the dll files and to start java referring to them in the classpath option - but no success.

      please let me know if you want more information or would like me to test on a different windows platform.

        Issue Links

          Activity

          Derek Bradley created issue -
          Hide
          Philippe Weber added a comment -

          It seems you can go one little step further by following the info from https://github.com/jruby/warbler/issues/67#issuecomment-3751457

          In short just modify logstash jar with 7zip to edit gems\jruby-win32ole-0.8.5\lib\jruby-win32ole.rb and hardcode the path to racob dll.

          I tried locally on my Win7 but then got another StackTrace, but maybe that's just my env

          Exception in thread "input|LogStash::Inputs::EventLog: {"type"=>"Windows-Eventlog", "name"=>"System", "debug"=>false, "add_field"=>{}}" org.racob.com.
          ComFailException: IEnumVARIANT::Next
                  at org.racob.com.EnumVariant.Next(Native Method)
          
          Show
          Philippe Weber added a comment - It seems you can go one little step further by following the info from https://github.com/jruby/warbler/issues/67#issuecomment-3751457 In short just modify logstash jar with 7zip to edit gems\jruby-win32ole-0.8.5\lib\jruby-win32ole.rb and hardcode the path to racob dll. I tried locally on my Win7 but then got another StackTrace, but maybe that's just my env Exception in thread "input|LogStash::Inputs::EventLog: {" type "=>" Windows-Eventlog ", " name "=>" System ", " debug "=> false , " add_field "=>{}}" org.racob.com. ComFailException: IEnumVARIANT::Next at org.racob.com.EnumVariant.Next(Native Method)
          Hide
          Patric Buskas added a comment -

          I found a way to get rid of the error, maybe it's the solution for this error.

          Check out the code and edit lib/logstash/inputs/eventlog.rb:53, change it to:

          require "jruby-win32ole" # rubygem 'win32ole' ('jruby-win32ole' on JRuby)
          

          and build it with

           make jar
          

          I assume the down-loadable jar file on logstash homepage is built with the default line with win32ole as requirement even though I think it needs the jruby-win32ole.

          This won't solve the main problem though.
          Logstash is now crashing with:

           java -jar logstash-1.1.6.dev-monolithic.jar agent -f logstash.conf
          Exception in thread "LogStash::Runner" org.jruby.exceptions.RaiseException: (LoadError) no such file to load -- racob
                  at org.jruby.RubyKernel.require(org/jruby/RubyKernel.java:1027)
                  at Kernel.require(jar:file:/C:/Users/patric/logstash/logstash-1.1.6.dev-monolithic.jar!/META-INF/jruby.home/lib/ruby/shared/rubygems/custom_require.rb:36)
                  at logstash.runner.require(logstash/runner.rb:10)
                  at RUBY.(root)(file:/C:/Users/patric/logstash/logstash-1.1.6.dev-monolithic.jar!/jruby-win32ole.rb:8)
                  at org.jruby.RubyKernel.require(org/jruby/RubyKernel.java:1027)
                  at Kernel.require(jar:file:/C:/Users/patric/logstash/logstash-1.1.6.dev-monolithic.jar!/META-INF/jruby.home/lib/ruby/shared/rubygems/custom_require.rb:36)
                  at logstash.runner.require(logstash/runner.rb:10)
                  at RUBY.(root)(file:/C:/Users/patric/logstash/logstash-1.1.6.dev-monolithic.jar!/logstash/inputs/eventlog.rb:1)
                  at RUBY.register(file:/C:/Users/patric/logstash/logstash-1.1.6.dev-monolithic.jar!/logstash/inputs/eventlog.rb:53)
                  at org.jruby.ext.thread.Mutex.synchronize(org/jruby/ext/thread/Mutex.java:149)
                  at RUBY.run_input(file:/C:/Users/patric/logstash/logstash-1.1.6.dev-monolithic.jar!/logstash/agent.rb:707)
                  at RUBY.run_input(file:/C:/Users/patric/logstash/logstash-1.1.6.dev-monolithic.jar!/logstash/agent.rb:707)
          
          Show
          Patric Buskas added a comment - I found a way to get rid of the error, maybe it's the solution for this error. Check out the code and edit lib/logstash/inputs/eventlog.rb:53, change it to: require "jruby-win32ole" # rubygem 'win32ole' ('jruby-win32ole' on JRuby) and build it with make jar I assume the down-loadable jar file on logstash homepage is built with the default line with win32ole as requirement even though I think it needs the jruby-win32ole. This won't solve the main problem though. Logstash is now crashing with: java -jar logstash-1.1.6.dev-monolithic.jar agent -f logstash.conf Exception in thread "LogStash::Runner" org.jruby.exceptions.RaiseException: (LoadError) no such file to load -- racob at org.jruby.RubyKernel.require(org/jruby/RubyKernel.java:1027) at Kernel.require(jar:file:/C:/Users/patric/logstash/logstash-1.1.6.dev-monolithic.jar!/META-INF/jruby.home/lib/ruby/shared/rubygems/custom_require.rb:36) at logstash.runner.require(logstash/runner.rb:10) at RUBY.(root)(file:/C:/Users/patric/logstash/logstash-1.1.6.dev-monolithic.jar!/jruby-win32ole.rb:8) at org.jruby.RubyKernel.require(org/jruby/RubyKernel.java:1027) at Kernel.require(jar:file:/C:/Users/patric/logstash/logstash-1.1.6.dev-monolithic.jar!/META-INF/jruby.home/lib/ruby/shared/rubygems/custom_require.rb:36) at logstash.runner.require(logstash/runner.rb:10) at RUBY.(root)(file:/C:/Users/patric/logstash/logstash-1.1.6.dev-monolithic.jar!/logstash/inputs/eventlog.rb:1) at RUBY.register(file:/C:/Users/patric/logstash/logstash-1.1.6.dev-monolithic.jar!/logstash/inputs/eventlog.rb:53) at org.jruby.ext.thread.Mutex.synchronize(org/jruby/ext/thread/Mutex.java:149) at RUBY.run_input(file:/C:/Users/patric/logstash/logstash-1.1.6.dev-monolithic.jar!/logstash/agent.rb:707) at RUBY.run_input(file:/C:/Users/patric/logstash/logstash-1.1.6.dev-monolithic.jar!/logstash/agent.rb:707)
          Philippe Weber made changes -
          Field Original Value New Value
          Link This issue discovered while testing LOGSTASH-836 [ LOGSTASH-836 ]
          Hide
          Philippe Weber added a comment - - edited

          Here is the my current path for exploring further this issue, if someone else can try to reproduce or have an idea about the last error:
          Status: Eventlog input starting successfully but then failing repeatedly after a few events received
          LastError:

          ←[31mWindows Event Log error: IEnumVARIANT::Next
          ["org.racob.com.EnumVariant.Next(Native Method)", "org.racob.com.EnumVariant.hasMoreElements(EnumVariant.java:47)", "org.jruby.ext.win32ole.RubyWIN32O
          LE.each(RubyWIN32OLE.java:64)", "org.jruby.ext.win32ole.RubyWIN32OLE$INVOKER$i$0$0$each.call(RubyWIN32OLE$INVOKER$i$0$0$each.gen)", "org.jruby.runtime
          .callsite.CachingCallSite.callBlock(CachingCallSite.java:143)", "org.jruby.runtime.callsite.CachingCallSite.callIter(CachingCallSite.java:154)", "org.
          jruby.ast.CallNoArgBlockNode.interpret(CallNoArgBlockNode.java:64)", "org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)", "org.jruby.ast.Block
          Node.interpret(BlockNode.java:71)", "org.jruby.evaluator.ASTInterpreter.INTERPRET_BLOCK(ASTInterpreter.java:112)", "org.jruby.runtime.Interpreted19Blo
          ck.evalBlockBody(Interpreted19Block.java:209)", "org.jruby.runtime.Interpreted19Block.yield(Interpreted19Block.java:160)", "org.jruby.runtime.Interpre
          ted19Block.yieldSpecific(Interpreted19Block.java:133)", "org.jruby.runtime.Block.yieldSpecific(Block.java:99)", "org.jruby.RubyKernel.loop(RubyKernel.
          java:1392)", "org.jruby.RubyKernel$INVOKER$s$0$0$loop.call(RubyKernel$INVOKER$s$0$0$loop.gen)", "org.jruby.runtime.callsite.CachingCallSite.callBlock(
          CachingCallSite.java:143)", "org.jruby.runtime.callsite.CachingCallSite.callIter(CachingCallSite.java:154)", "org.jruby.ast.FCallNoArgBlockNode.interp
          ret(FCallNoArgBlockNode.java:32)", "org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)", "org.jruby.ast.BlockNode.interpret(BlockNode.java:71)"
          , "org.jruby.ast.RescueNode.executeBody(RescueNode.java:224)", "org.jruby.ast.RescueNode.interpret(RescueNode.java:119)", "org.jruby.ast.BeginNode.int
          erpret(BeginNode.java:83)", "org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)", "org.jruby.ast.BlockNode.interpret(BlockNode.java:71)", "org.
          jruby.evaluator.ASTInterpreter.INTERPRET_METHOD(ASTInterpreter.java:75)", "org.jruby.internal.runtime.methods.InterpretedMethod.call(InterpretedMethod
          .java:182)", "org.jruby.internal.runtime.methods.DefaultMethod.call(DefaultMethod.java:188)", "org.jruby.runtime.callsite.CachingCallSite.cacheAndCall
          (CachingCallSite.java:326)", "org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:170)", "org.jruby.ast.CallOneArgNode.interpret(Call
          OneArgNode.java:57)", "org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)", "org.jruby.ast.BlockNode.interpret(BlockNode.java:71)", "org.jruby.
          ast.RescueNode.executeBody(RescueNode.java:224)", "org.jruby.ast.RescueNode.interpret(RescueNode.java:119)", "org.jruby.ast.BeginNode.interpret(BeginN
          ode.java:83)", "org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)", "org.jruby.ast.WhileNode.interpret(WhileNode.java:131)", "org.jruby.ast.Ne
          wlineNode.interpret(NewlineNode.java:105)", "org.jruby.ast.BlockNode.interpret(BlockNode.java:71)", "org.jruby.evaluator.ASTInterpreter.INTERPRET_METH
          OD(ASTInterpreter.java:75)", "org.jruby.internal.runtime.methods.InterpretedMethod.call(InterpretedMethod.java:225)", "org.jruby.internal.runtime.meth
          ods.DefaultMethod.call(DefaultMethod.java:204)", "org.jruby.runtime.callsite.CachingCallSite.cacheAndCall(CachingCallSite.java:346)", "org.jruby.runti
          me.callsite.CachingCallSite.call(CachingCallSite.java:204)", "org.jruby.ast.FCallSpecialArgNode.interpret(FCallSpecialArgNode.java:41)", "org.jruby.as
          t.NewlineNode.interpret(NewlineNode.java:105)", "org.jruby.evaluator.ASTInterpreter.INTERPRET_BLOCK(ASTInterpreter.java:112)", "org.jruby.runtime.Inte
          rpreted19Block.evalBlockBody(Interpreted19Block.java:209)", "org.jruby.runtime.Interpreted19Block.yield(Interpreted19Block.java:197)", "org.jruby.runt
          ime.Interpreted19Block.call(Interpreted19Block.java:128)", "org.jruby.runtime.Block.call(Block.java:89)", "org.jruby.RubyProc.call(RubyProc.java:261)"
          , "org.jruby.RubyProc.call(RubyProc.java:213)", "org.jruby.internal.runtime.RubyRunnable.run(RubyRunnable.java:98)", "java.lang.Thread.run(Unknown Sou
          rce)"] {:level=>:error, :file=>"/temp/logstash-1.1.7-monolithic.jar!/logstash/inputs/eventlog.rb", :line=>"97", :method=>"run"}←[0m
          

          Steps to have a running eventlog input:

          • Get logstash-1.1.7
          • Unzip it
          • Copy the racob.dll out of the jar from gems\jruby-win32ole-0.8.5\lib to where you want
          • Modify the jruby-win32ole.rb present at the root of the archive
            • Remove the line require racob.jar (useless as logstash uberjar manage it already)
            • Change the line File.dirname(_FILE_) + "/racob-#{arch}.dll" to an absolute path where the dll are like "D:/temp/racob-#{arch}.dll"*
          • Modifiy the logstash/inputs/eventlog.rb to change require in line 53 from win32ole to jruby-win32ole
          • Rezip to a jar
          • Can be launched without exception
          • Receive a few events
          • Will constantly fail with a racob exception (see above)

          Info sources:

          If a ruby guru could find a few time to provide a fix to jruby-win32ole, maybe inspiration can be found on how ffi-rzmq handle dll loading from the PATH https://github.com/chuckremes/ffi-rzmq/blob/master/lib/ffi-rzmq/libzmq.rb

          Show
          Philippe Weber added a comment - - edited Here is the my current path for exploring further this issue, if someone else can try to reproduce or have an idea about the last error: Status: Eventlog input starting successfully but then failing repeatedly after a few events received LastError: ←[31mWindows Event Log error: IEnumVARIANT::Next [ "org.racob.com.EnumVariant.Next(Native Method)" , "org.racob.com.EnumVariant.hasMoreElements(EnumVariant.java:47)" , "org.jruby.ext.win32ole.RubyWIN32O LE.each(RubyWIN32OLE.java:64) ", " org.jruby.ext.win32ole.RubyWIN32OLE$INVOKER$i$0$0$each.call(RubyWIN32OLE$INVOKER$i$0$0$each.gen) ", " org.jruby.runtime .callsite.CachingCallSite.callBlock(CachingCallSite.java:143) ", " org.jruby.runtime.callsite.CachingCallSite.callIter(CachingCallSite.java:154) ", " org. jruby.ast.CallNoArgBlockNode.interpret(CallNoArgBlockNode.java:64) ", " org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105) ", " org.jruby.ast.Block Node.interpret(BlockNode.java:71) ", " org.jruby.evaluator.ASTInterpreter.INTERPRET_BLOCK(ASTInterpreter.java:112) ", " org.jruby.runtime.Interpreted19Blo ck.evalBlockBody(Interpreted19Block.java:209) ", " org.jruby.runtime.Interpreted19Block.yield(Interpreted19Block.java:160) ", " org.jruby.runtime.Interpre ted19Block.yieldSpecific(Interpreted19Block.java:133) ", " org.jruby.runtime.Block.yieldSpecific(Block.java:99) ", " org.jruby.RubyKernel.loop(RubyKernel. java:1392) ", " org.jruby.RubyKernel$INVOKER$s$0$0$loop.call(RubyKernel$INVOKER$s$0$0$loop.gen) ", " org.jruby.runtime.callsite.CachingCallSite.callBlock( CachingCallSite.java:143) ", " org.jruby.runtime.callsite.CachingCallSite.callIter(CachingCallSite.java:154) ", " org.jruby.ast.FCallNoArgBlockNode.interp ret(FCallNoArgBlockNode.java:32) ", " org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105) ", " org.jruby.ast.BlockNode.interpret(BlockNode.java:71)" , "org.jruby.ast.RescueNode.executeBody(RescueNode.java:224)" , "org.jruby.ast.RescueNode.interpret(RescueNode.java:119)" , "org.jruby.ast.BeginNode. int erpret(BeginNode.java:83) ", " org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105) ", " org.jruby.ast.BlockNode.interpret(BlockNode.java:71) ", " org. jruby.evaluator.ASTInterpreter.INTERPRET_METHOD(ASTInterpreter.java:75) ", " org.jruby.internal.runtime.methods.InterpretedMethod.call(InterpretedMethod .java:182) ", " org.jruby.internal.runtime.methods.DefaultMethod.call(DefaultMethod.java:188) ", " org.jruby.runtime.callsite.CachingCallSite.cacheAndCall (CachingCallSite.java:326) ", " org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:170) ", " org.jruby.ast.CallOneArgNode.interpret(Call OneArgNode.java:57) ", " org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105) ", " org.jruby.ast.BlockNode.interpret(BlockNode.java:71) ", " org.jruby. ast.RescueNode.executeBody(RescueNode.java:224) ", " org.jruby.ast.RescueNode.interpret(RescueNode.java:119) ", " org.jruby.ast.BeginNode.interpret(BeginN ode.java:83) ", " org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105) ", " org.jruby.ast.WhileNode.interpret(WhileNode.java:131) ", " org.jruby.ast.Ne wlineNode.interpret(NewlineNode.java:105) ", " org.jruby.ast.BlockNode.interpret(BlockNode.java:71) ", " org.jruby.evaluator.ASTInterpreter.INTERPRET_METH OD(ASTInterpreter.java:75) ", " org.jruby.internal.runtime.methods.InterpretedMethod.call(InterpretedMethod.java:225) ", " org.jruby.internal.runtime.meth ods.DefaultMethod.call(DefaultMethod.java:204) ", " org.jruby.runtime.callsite.CachingCallSite.cacheAndCall(CachingCallSite.java:346) ", " org.jruby.runti me.callsite.CachingCallSite.call(CachingCallSite.java:204) ", " org.jruby.ast.FCallSpecialArgNode.interpret(FCallSpecialArgNode.java:41) ", " org.jruby.as t.NewlineNode.interpret(NewlineNode.java:105) ", " org.jruby.evaluator.ASTInterpreter.INTERPRET_BLOCK(ASTInterpreter.java:112) ", " org.jruby.runtime.Inte rpreted19Block.evalBlockBody(Interpreted19Block.java:209) ", " org.jruby.runtime.Interpreted19Block.yield(Interpreted19Block.java:197) ", " org.jruby.runt ime.Interpreted19Block.call(Interpreted19Block.java:128) ", " org.jruby.runtime.Block.call(Block.java:89) ", " org.jruby.RubyProc.call(RubyProc.java:261)" , "org.jruby.RubyProc.call(RubyProc.java:213)" , "org.jruby.internal.runtime.RubyRunnable.run(RubyRunnable.java:98)" , "java.lang. Thread .run(Unknown Sou rce) "] {:level=>:error, :file=>" /temp/logstash-1.1.7-monolithic.jar!/logstash/inputs/eventlog.rb ", :line=>" 97 ", :method=>" run"}←[0m Steps to have a running eventlog input: Get logstash-1.1.7 Unzip it Copy the racob.dll out of the jar from gems\jruby-win32ole-0.8.5\lib to where you want Modify the jruby-win32ole.rb present at the root of the archive Remove the line require racob.jar (useless as logstash uberjar manage it already) Change the line File.dirname(_ FILE _) + "/racob-#{arch}.dll" to an absolute path where the dll are like "D:/temp/racob-#{arch}.dll"* Modifiy the logstash/inputs/eventlog.rb to change require in line 53 from win32ole to jruby-win32ole Rezip to a jar Can be launched without exception Receive a few events Will constantly fail with a racob exception (see above) Info sources: https://github.com/jruby/warbler/issues/67#issuecomment-3751457 http://jira.codehaus.org/browse/JRUBY-4880 If a ruby guru could find a few time to provide a fix to jruby-win32ole, maybe inspiration can be found on how ffi-rzmq handle dll loading from the PATH https://github.com/chuckremes/ffi-rzmq/blob/master/lib/ffi-rzmq/libzmq.rb
          Hide
          Axel Sanner added a comment -

          I am also stuck on this error as of 1.1.9. Does anyone know of any solution or if anybody hos a working implementation?

          Show
          Axel Sanner added a comment - I am also stuck on this error as of 1.1.9. Does anyone know of any solution or if anybody hos a working implementation?
          Hide
          Paul Tinsley added a comment -

          Throwing a me too on this one with 1.1.9:

          {:message=>"Input thread exception", :plugin=>#<LogStash::Inputs::EventLog:0xf0d06c9 @add_field={}, @charset="UTF-8", @hostname="LVPTINSLEYWIN8", @format="json_event", 
          @config={"type"=>"Win32-EventLog", "logfile"=>"Security", "debug"=>false, "charset"=>"UTF-8", "add_field"=>{}}, @type="Win32-EventLog", @threadable=false, @tags=[], 
          @wmi=#<WIN32OLE:0xd13998e>, @params={"type"=>"Win32-EventLog", "logfile"=>"Security", "debug"=>false, "charset"=>"UTF-8", "add_field"=>{}}, @logfile="Security", @debug=false, 
          @logger=#<LogStash::Logger:0x5ccdbec7 @target=#<IO:fd 2>, @subscriber_lock=#<Mutex:0x7178b9e6>, @metrics=#<Cabin::Metrics:0x2cf4e53d @channel=#<Cabin::Channel:0x1f61eda 
          @subscriber_lock=#<Mutex:0x45637b37>, @data={}, @metrics=#<Cabin::Metrics:0x62e7b78 @channel=#<Cabin::Channel:0x1f61eda ...>, @metrics={}, @metrics_lock=#<Mutex:0x55ac0673>>, 
          @subscribers={}, @level=:info>, @metrics={}, @metrics_lock=#<Mutex:0x10db93f6>>, @data={}, @subscribers={2030=>#<Cabin::Outputs::IO:0x6320932f @lock=#<Mutex:0x6f9f2580>, @io=#<IO:fd 2>>}, 
          @level=:warn>>, :exception=>org.racob.com.ComFailException: IEnumVARIANT::Next, :backtrace=>["org.racob.com.EnumVariant.Next(Native Method)", 
          "org.racob.com.EnumVariant.hasMoreElements(EnumVariant.java:47)", "org.jruby.ext.win32ole.RubyWIN32OLE.each(RubyWIN32OLE.java:64)", 
          "org.jruby.ext.win32ole.RubyWIN32OLE$INVOKER$i$0$0$each.call(RubyWIN32OLE$INVOKER$i$0$0$each.gen)", "org.jruby.runtime.callsite.CachingCallSite.callBlock(CachingCallSite.java:143)", 
          "org.jruby.runtime.callsite.CachingCallSite.callIter(CachingCallSite.java:154)", "org.jruby.ast.CallNoArgBlockNode.interpret(CallNoArgBlockNode.java:64)", 
          "org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)", "org.jruby.ast.BlockNode.interpret(BlockNode.java:71)", 
          "org.jruby.evaluator.ASTInterpreter.INTERPRET_METHOD(ASTInterpreter.java:75)", "org.jruby.internal.runtime.methods.InterpretedMethod.call(InterpretedMethod.java:139)", 
          "org.jruby.internal.runtime.methods.DefaultMethod.call(DefaultMethod.java:172)", "org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:134)", 
          "org.jruby.ast.VCallNode.interpret(VCallNode.java:88)", "org.jruby.ast.LocalAsgnNode.interpret(LocalAsgnNode.java:123)", "org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)", 
          "org.jruby.ast.BlockNode.interpret(BlockNode.java:71)", "org.jruby.evaluator.ASTInterpreter.INTERPRET_METHOD(ASTInterpreter.java:75)", 
          "org.jruby.internal.runtime.methods.InterpretedMethod.call(InterpretedMethod.java:182)", "org.jruby.internal.runtime.methods.DefaultMethod.call(DefaultMethod.java:188)", 
          "org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:168)", "org.jruby.ast.CallOneArgNode.interpret(CallOneArgNode.java:57)", 
          "org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)", "org.jruby.ast.BlockNode.interpret(BlockNode.java:71)", "org.jruby.ast.RescueNode.executeBody(RescueNode.java:224)", 
          "org.jruby.ast.RescueNode.interpret(RescueNode.java:119)", "org.jruby.ast.BeginNode.interpret(BeginNode.java:83)", "org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)", 
          "org.jruby.ast.WhileNode.interpret(WhileNode.java:131)", "org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)", "org.jruby.ast.BlockNode.interpret(BlockNode.java:71)", 
          "org.jruby.evaluator.ASTInterpreter.INTERPRET_METHOD(ASTInterpreter.java:75)", "org.jruby.internal.runtime.methods.InterpretedMethod.call(InterpretedMethod.java:225)", 
          "org.jruby.internal.runtime.methods.DefaultMethod.call(DefaultMethod.java:204)", "org.jruby.runtime.callsite.CachingCallSite.cacheAndCall(CachingCallSite.java:346)", 
          "org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:204)", "org.jruby.ast.FCallSpecialArgNode.interpret(FCallSpecialArgNode.java:41)", 
          "org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)", "org.jruby.evaluator.ASTInterpreter.INTERPRET_BLOCK(ASTInterpreter.java:112)", 
          "org.jruby.runtime.Interpreted19Block.evalBlockBody(Interpreted19Block.java:209)", "org.jruby.runtime.Interpreted19Block.yield(Interpreted19Block.java:197)", 
          "org.jruby.runtime.Interpreted19Block.call(Interpreted19Blo
          ck.java:128)", "org.jruby.runtime.Block.call(Block.java:89)", "org.jruby.RubyProc.call(RubyProc.java:261)", "org.jruby.RubyProc.call(RubyProc.java:213)", 
          "org.jruby.internal.runtime.RubyRunnable.run(RubyRunnable.java:98)", "java.lang.Thread.run(Unknown Source)"], :level=>:warn}
          
          {:message=>"Restarting input due to exception", :plugin=>#<LogStash::Inputs::EventLog:0xf0d06c9 @add_field={}, @charset="UTF-8", @hostname="XXXXXXXX", @format="json_event", 
          @config={"type"=>"Win32-EventLog", "logfile"=>"Security", "debug"=>false, "charset"=>"UTF-8", "add_field"=>{}}, @type="Win32-EventLog", @threadable=false, @tags=[], 
          @wmi=#<WIN32OLE:0xd13998e>, @params={"type"=>"Win32-EventLog", "logfile"=>"Security", "debug"=>false, "charset"=>"UTF-8", "add_field"=>{}}, @logfile="Security", @debug=false, 
          @logger=#<LogStash::Logger:0x5ccdbec7 @target=#<IO:fd 2>, @subscriber_lock=#<Mutex:0x7178b9e6>, @metrics=#<Cabin::Metrics:0x2cf4e53d @channel=#<Cabin::Channel:0x1f61eda 
          @subscriber_lock=#<Mutex:0x45637b37>, @data={}, @metrics=#<Cabin::Metrics:0x62e7b78 @channel=#<Cabin::Channel:0x1f61eda ...>, @metrics={}, @metrics_lock=#<Mutex:0x55ac0673>>, 
          @subscribers={}, @level=:info>, @metrics={}, @metrics_lock=#<Mutex:0x10db93f6>>, @data={}, @subscribers={2030=>#<Cabin::Outputs::IO:0x6320932f @lock=#<Mutex:0x6f9f2580>, @io=#<IO:fd 2>>}, 
          @level=:warn>>, :level=>:error}
          
          Show
          Paul Tinsley added a comment - Throwing a me too on this one with 1.1.9: {:message=>"Input thread exception", :plugin=>#<LogStash::Inputs::EventLog:0xf0d06c9 @add_field={}, @charset="UTF-8", @hostname="LVPTINSLEYWIN8", @format="json_event", @config={"type"=>"Win32-EventLog", "logfile"=>"Security", "debug"=>false, "charset"=>"UTF-8", "add_field"=>{}}, @type="Win32-EventLog", @threadable=false, @tags=[], @wmi=#<WIN32OLE:0xd13998e>, @params={"type"=>"Win32-EventLog", "logfile"=>"Security", "debug"=>false, "charset"=>"UTF-8", "add_field"=>{}}, @logfile="Security", @debug=false, @logger=#<LogStash::Logger:0x5ccdbec7 @target=#<IO:fd 2>, @subscriber_lock=#<Mutex:0x7178b9e6>, @metrics=#<Cabin::Metrics:0x2cf4e53d @channel=#<Cabin::Channel:0x1f61eda @subscriber_lock=#<Mutex:0x45637b37>, @data={}, @metrics=#<Cabin::Metrics:0x62e7b78 @channel=#<Cabin::Channel:0x1f61eda ...>, @metrics={}, @metrics_lock=#<Mutex:0x55ac0673>>, @subscribers={}, @level=:info>, @metrics={}, @metrics_lock=#<Mutex:0x10db93f6>>, @data={}, @subscribers={2030=>#<Cabin::Outputs::IO:0x6320932f @lock=#<Mutex:0x6f9f2580>, @io=#<IO:fd 2>>}, @level=:warn>>, :exception=>org.racob.com.ComFailException: IEnumVARIANT::Next, :backtrace=>["org.racob.com.EnumVariant.Next(Native Method)", "org.racob.com.EnumVariant.hasMoreElements(EnumVariant.java:47)", "org.jruby.ext.win32ole.RubyWIN32OLE.each(RubyWIN32OLE.java:64)", "org.jruby.ext.win32ole.RubyWIN32OLE$INVOKER$i$0$0$each.call(RubyWIN32OLE$INVOKER$i$0$0$each.gen)", "org.jruby.runtime.callsite.CachingCallSite.callBlock(CachingCallSite.java:143)", "org.jruby.runtime.callsite.CachingCallSite.callIter(CachingCallSite.java:154)", "org.jruby.ast.CallNoArgBlockNode.interpret(CallNoArgBlockNode.java:64)", "org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)", "org.jruby.ast.BlockNode.interpret(BlockNode.java:71)", "org.jruby.evaluator.ASTInterpreter.INTERPRET_METHOD(ASTInterpreter.java:75)", "org.jruby.internal.runtime.methods.InterpretedMethod.call(InterpretedMethod.java:139)", "org.jruby.internal.runtime.methods.DefaultMethod.call(DefaultMethod.java:172)", "org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:134)", "org.jruby.ast.VCallNode.interpret(VCallNode.java:88)", "org.jruby.ast.LocalAsgnNode.interpret(LocalAsgnNode.java:123)", "org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)", "org.jruby.ast.BlockNode.interpret(BlockNode.java:71)", "org.jruby.evaluator.ASTInterpreter.INTERPRET_METHOD(ASTInterpreter.java:75)", "org.jruby.internal.runtime.methods.InterpretedMethod.call(InterpretedMethod.java:182)", "org.jruby.internal.runtime.methods.DefaultMethod.call(DefaultMethod.java:188)", "org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:168)", "org.jruby.ast.CallOneArgNode.interpret(CallOneArgNode.java:57)", "org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)", "org.jruby.ast.BlockNode.interpret(BlockNode.java:71)", "org.jruby.ast.RescueNode.executeBody(RescueNode.java:224)", "org.jruby.ast.RescueNode.interpret(RescueNode.java:119)", "org.jruby.ast.BeginNode.interpret(BeginNode.java:83)", "org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)", "org.jruby.ast.WhileNode.interpret(WhileNode.java:131)", "org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)", "org.jruby.ast.BlockNode.interpret(BlockNode.java:71)", "org.jruby.evaluator.ASTInterpreter.INTERPRET_METHOD(ASTInterpreter.java:75)", "org.jruby.internal.runtime.methods.InterpretedMethod.call(InterpretedMethod.java:225)", "org.jruby.internal.runtime.methods.DefaultMethod.call(DefaultMethod.java:204)", "org.jruby.runtime.callsite.CachingCallSite.cacheAndCall(CachingCallSite.java:346)", "org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:204)", "org.jruby.ast.FCallSpecialArgNode.interpret(FCallSpecialArgNode.java:41)", "org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)", "org.jruby.evaluator.ASTInterpreter.INTERPRET_BLOCK(ASTInterpreter.java:112)", "org.jruby.runtime.Interpreted19Block.evalBlockBody(Interpreted19Block.java:209)", "org.jruby.runtime.Interpreted19Block.yield(Interpreted19Block.java:197)", "org.jruby.runtime.Interpreted19Block.call(Interpreted19Blo ck.java:128)", "org.jruby.runtime.Block.call(Block.java:89)", "org.jruby.RubyProc.call(RubyProc.java:261)", "org.jruby.RubyProc.call(RubyProc.java:213)", "org.jruby.internal.runtime.RubyRunnable.run(RubyRunnable.java:98)", "java.lang.Thread.run(Unknown Source)"], :level=>:warn} {:message=>"Restarting input due to exception", :plugin=>#<LogStash::Inputs::EventLog:0xf0d06c9 @add_field={}, @charset="UTF-8", @hostname="XXXXXXXX", @format="json_event", @config={"type"=>"Win32-EventLog", "logfile"=>"Security", "debug"=>false, "charset"=>"UTF-8", "add_field"=>{}}, @type="Win32-EventLog", @threadable=false, @tags=[], @wmi=#<WIN32OLE:0xd13998e>, @params={"type"=>"Win32-EventLog", "logfile"=>"Security", "debug"=>false, "charset"=>"UTF-8", "add_field"=>{}}, @logfile="Security", @debug=false, @logger=#<LogStash::Logger:0x5ccdbec7 @target=#<IO:fd 2>, @subscriber_lock=#<Mutex:0x7178b9e6>, @metrics=#<Cabin::Metrics:0x2cf4e53d @channel=#<Cabin::Channel:0x1f61eda @subscriber_lock=#<Mutex:0x45637b37>, @data={}, @metrics=#<Cabin::Metrics:0x62e7b78 @channel=#<Cabin::Channel:0x1f61eda ...>, @metrics={}, @metrics_lock=#<Mutex:0x55ac0673>>, @subscribers={}, @level=:info>, @metrics={}, @metrics_lock=#<Mutex:0x10db93f6>>, @data={}, @subscribers={2030=>#<Cabin::Outputs::IO:0x6320932f @lock=#<Mutex:0x6f9f2580>, @io=#<IO:fd 2>>}, @level=:warn>>, :level=>:error}
          Hide
          Jordan Sissel added a comment -

          Verified master working on windows.

          I can use the 'eventlog' input successfully as of now.

          http://jls.objects.dreamhost.com/images/windows-logstash.2013-04-09T01:56:45.png

          Next release will have it the fix.

          Show
          Jordan Sissel added a comment - Verified master working on windows. I can use the 'eventlog' input successfully as of now. http://jls.objects.dreamhost.com/images/windows-logstash.2013-04-09T01:56:45.png Next release will have it the fix.
          Jordan Sissel made changes -
          Status Open [ 1 ] Resolved [ 5 ]
          Assignee Logstash Developers [ logstash-dev ] Jordan Sissel [ jls ]
          Fix Version/s NEXT [ 10820 ]
          Resolution Fixed [ 1 ]
          Jordan Sissel made changes -
          Issue Type Bug [ 1 ] Bug/Feature [ 9 ]
          Jordan Sissel made changes -
          Workflow jira [ 13812 ] logstash [ 16915 ]
          Jordan Sissel made changes -
          Workflow logstash [ 16915 ] logstash workflow backup 2013-04-25 [ 17432 ]
          Jordan Sissel made changes -
          Workflow logstash workflow backup 2013-04-25 [ 17432 ] logstash [ 18385 ]
          Hide
          Mark Plaksin added a comment -

          With 1.1.12, I get the same behavior as in the 11/Jan/13 5:28 AM update.
          Here's a sample success followed by the errors:

          {:timestamp=>"2013-05-08T14:35:39.396000-0400", :message=>"All plugins are started and registered.", :level=>:info}
          {
                 "@source" => "eventlog://HAPPY/System",
                   "@tags" => [],
                 "@fields" => {
                          "Category" => 0,
                    "CategoryString" => nil,
                      "ComputerName" => "HAPPY.jojo.com",
                         "EventCode" => 7036,
                   "EventIdentifier" => 1073748860,
                         "EventType" => 3,
                           "Logfile" => "System",
                           "Message" => "The NSClient++ (x64) service entered the stopped state.",
                      "RecordNumber" => 262939,
                        "SourceName" => "Service Control Manager",
                     "TimeGenerated" => "20130508183610.318806-000",
                       "TimeWritten" => "20130508183610.318806-000",
                              "Type" => "Information",
                              "User" => nil,
                  "InsertionStrings" => [
                      [0] "NSClient++ (x64)",
                      [1] "stopped"
                  ],
                              "Data" => "N\x00S\x00C\x00l\x00i\x00e\x00n\x00t\x00p\x00p\x00/\x001\x00\x00\x00"
              },
                   "@type" => "Win32-EventLog",
              "@timestamp" => "2013-05-08T18:36:10-04:00",
                "@message" => "The NSClient++ (x64) service entered the stopped state."
          }
          {:timestamp=>"2013-05-08T14:38:03.600000-0400", :message=>"Windows Event Log error: IEnumVARIANT::Next\n[\"org.racob.com.EnumVariant.Next(Native Method)\", \"org.racob.com.EnumVariant.hasMoreElements(EnumVariant.java:47)\", \"org.jruby.ext.win32ole.RubyWIN32OLE.each(RubyWIN32OLE.java:64)\", \"org.jruby.ext.win32ole.RubyWIN32OLE$INVOKER$i$0$0$each.call(RubyWIN32OLE$INVOKER$i$0$0$each.gen)\", \"org.jruby.runtime.callsite.CachingCallSite.callBlock(CachingCallSite.java:143)\", \"org.jruby.runtime.callsite.CachingCallSite.callIter(CachingCallSite.java:154)\", \"org.jruby.ast.CallNoArgBlockNode.interpret(CallNoArgBlockNode.java:64)\", \"org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)\", \"org.jruby.ast.BlockNode.interpret(BlockNode.java:71)\", \"org.jruby.evaluator.ASTInterpreter.INTERPRET_BLOCK(ASTInterpreter.java:112)\", \"org.jruby.runtime.Interpreted19Block.evalBlockBody(Interpreted19Block.java:209)\", \"org.jruby.runtime.Interpreted19Block.yield(Interpreted19Block.java:160)\", \"org.jruby.runtime.Interpreted19Block.yieldSpecific(Interpreted19Block.java:133)\", \"org.jruby.runtime.Block.yieldSpecific(Block.java:99)\", \"org.jruby.RubyKernel.loop(RubyKernel.java:1409)\", \"org.jruby.RubyKernel$INVOKER$s$0$0$loop.call(RubyKernel$INVOKER$s$0$0$loop.gen)\", \"org.jruby.runtime.callsite.CachingCallSite.cacheAndCall(CachingCallSite.java:316)\", \"org.jruby.runtime.callsite.CachingCallSite.callBlock(CachingCallSite.java:145)\", \"org.jruby.runtime.callsite.CachingCallSite.callIter(CachingCallSite.java:154)\", \"org.jruby.ast.FCallNoArgBlockNode.interpret(FCallNoArgBlockNode.java:32)\", \"org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)\", \"org.jruby.ast.BlockNode.interpret(BlockNode.java:71)\", \"org.jruby.ast.RescueNode.executeBody(RescueNode.java:224)\", \"org.jruby.ast.RescueNode.interpret(RescueNode.java:119)\", \"org.jruby.ast.BeginNode.interpret(BeginNode.java:83)\", \"org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)\", \"org.jruby.ast.BlockNode.interpret(BlockNode.java:71)\", \"org.jruby.evaluator.ASTInterpreter.INTERPRET_METHOD(ASTInterpreter.java:75)\", \"org.jruby.internal.runtime.methods.InterpretedMethod.call(InterpretedMethod.java:182)\", \"org.jruby.internal.runtime.methods.DefaultMethod.call(DefaultMethod.java:188)\", \"org.jruby.runtime.callsite.CachingCallSite.cacheAndCall(CachingCallSite.java:326)\", \"org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:170)\", \"org.jruby.ast.CallOneArgNode.interpret(CallOneArgNode.java:57)\", \"org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)\", \"org.jruby.ast.BlockNode.interpret(BlockNode.java:71)\", \"org.jruby.ast.RescueNode.executeBody(RescueNode.java:224)\", \"org.jruby.ast.RescueNode.interpret(RescueNode.java:119)\", \"org.jruby.ast.BeginNode.interpret(BeginNode.java:83)\", \"org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)\", \"org.jruby.ast.WhileNode.interpret(WhileNode.java:131)\", \"org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)\", \"org.jruby.ast.BlockNode.interpret(BlockNode.java:71)\", \"org.jruby.evaluator.ASTInterpreter.INTERPRET_METHOD(ASTInterpreter.java:75)\", \"org.jruby.internal.runtime.methods.InterpretedMethod.call(InterpretedMethod.java:225)\", \"org.jruby.internal.runtime.methods.DefaultMethod.call(DefaultMethod.java:204)\", \"org.jruby.runtime.callsite.CachingCallSite.cacheAndCall(CachingCallSite.java:346)\", \"org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:204)\", \"org.jruby.ast.FCallSpecialArgNode.interpret(FCallSpecialArgNode.java:41)\", \"org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)\", \"org.jruby.evaluator.ASTInterpreter.INTERPRET_BLOCK(ASTInterpreter.java:112)\", \"org.jruby.runtime.Interpreted19Block.evalBlockBody(Interpreted19Block.java:209)\", \"org.jruby.runtime.Interpreted19Block.yield(Interpreted19Block.java:197)\", \"org.jruby.runtime.Interpreted19Block.call(Interpreted19Block.java:128)\", \"org.jruby.runtime.Block.call(Block.java:89)\", \"org.jruby.RubyProc.call(RubyProc.java:261)\", \"org.jruby.RubyProc.call(RubyProc.java:213)\", \"org.jruby.internal.runtime.RubyRunnable.run(RubyRunnable.java:98)\", \"java.lang.Thread.run(Unknown Source)\"]", :level=>:error}
          {:timestamp=>"2013-05-08T14:38:04.725000-0400", :message=>"Windows Event Log error: IEnumVARIANT::Next\n[\"org.racob.com.EnumVariant.Next(Native Method)\", \"org.racob.com.EnumVariant.hasMoreElements(EnumVariant.java:47)\", \"org.jruby.ext.win32ole.RubyWIN32OLE.each(RubyWIN32OLE.java:64)\", \"org.jruby.ext.win32ole.RubyWIN32OLE$INVOKER$i$0$0$each.call(RubyWIN32OLE$INVOKER$i$0$0$each.gen)\", \"org.jruby.runtime.callsite.CachingCallSite.callBlock(CachingCallSite.java:143)\", \"org.jruby.runtime.callsite.CachingCallSite.callIter(CachingCallSite.java:154)\", \"org.jruby.ast.CallNoArgBlockNode.interpret(CallNoArgBlockNode.java:64)\", \"org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)\", \"org.jruby.ast.BlockNode.interpret(BlockNode.java:71)\", \"org.jruby.evaluator.ASTInterpreter.INTERPRET_BLOCK(ASTInterpreter.java:112)\", \"org.jruby.runtime.Interpreted19Block.evalBlockBody(Interpreted19Block.java:209)\", \"org.jruby.runtime.Interpreted19Block.yield(Interpreted19Block.java:160)\", \"org.jruby.runtime.Interpreted19Block.yieldSpecific(Interpreted19Block.java:133)\", \"org.jruby.runtime.Block.yieldSpecific(Block.java:99)\", \"org.jruby.RubyKernel.loop(RubyKernel.java:1409)\", \"org.jruby.RubyKernel$INVOKER$s$0$0$loop.call(RubyKernel$INVOKER$s$0$0$loop.gen)\", \"org.jruby.runtime.callsite.CachingCallSite.callBlock(CachingCallSite.java:143)\", \"org.jruby.runtime.callsite.CachingCallSite.callIter(CachingCallSite.java:154)\", \"org.jruby.ast.FCallNoArgBlockNode.interpret(FCallNoArgBlockNode.java:32)\", \"org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)\", \"org.jruby.ast.BlockNode.interpret(BlockNode.java:71)\", \"org.jruby.ast.RescueNode.executeBody(RescueNode.java:224)\", \"org.jruby.ast.RescueNode.interpret(RescueNode.java:119)\", \"org.jruby.ast.BeginNode.interpret(BeginNode.java:83)\", \"org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)\", \"org.jruby.ast.BlockNode.interpret(BlockNode.java:71)\", \"org.jruby.evaluator.ASTInterpreter.INTERPRET_METHOD(ASTInterpreter.java:75)\", \"org.jruby.internal.runtime.methods.InterpretedMethod.call(InterpretedMethod.java:182)\", \"org.jruby.internal.runtime.methods.DefaultMethod.call(DefaultMethod.java:188)\", \"org.jruby.runtime.callsite.CachingCallSite.cacheAndCall(CachingCallSite.java:326)\", \"org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:170)\", \"org.jruby.ast.CallOneArgNode.interpret(CallOneArgNode.java:57)\", \"org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)\", \"org.jruby.ast.BlockNode.interpret(BlockNode.java:71)\", \"org.jruby.ast.RescueNode.executeBody(RescueNode.java:224)\", \"org.jruby.ast.RescueNode.interpret(RescueNode.java:119)\", \"org.jruby.ast.BeginNode.interpret(BeginNode.java:83)\", \"org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)\", \"org.jruby.ast.WhileNode.interpret(WhileNode.java:131)\", \"org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)\", \"org.jruby.ast.BlockNode.interpret(BlockNode.java:71)\", \"org.jruby.evaluator.ASTInterpreter.INTERPRET_METHOD(ASTInterpreter.java:75)\", \"org.jruby.internal.runtime.methods.InterpretedMethod.call(InterpretedMethod.java:225)\", \"org.jruby.internal.runtime.methods.DefaultMethod.call(DefaultMethod.java:204)\", \"org.jruby.runtime.callsite.CachingCallSite.cacheAndCall(CachingCallSite.java:346)\", \"org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:204)\", \"org.jruby.ast.FCallSpecialArgNode.interpret(FCallSpecialArgNode.java:41)\", \"org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)\", \"org.jruby.evaluator.ASTInterpreter.INTERPRET_BLOCK(ASTInterpreter.java:112)\", \"org.jruby.runtime.Interpreted19Block.evalBlockBody(Interpreted19Block.java:209)\", \"org.jruby.runtime.Interpreted19Block.yield(Interpreted19Block.java:197)\", \"org.jruby.runtime.Interpreted19Block.call(Interpreted19Block.java:128)\", \"org.jruby.runtime.Block.call(Block.java:89)\", \"org.jruby.RubyProc.call(RubyProc.java:261)\", \"org.jruby.RubyProc.call(RubyProc.java:213)\", \"org.jruby.internal.runtime.RubyRunnable.run(RubyRunnable.java:98)\", \"java.lang.Thread.run(Unknown Source)\"]", :level=>:error}
          
          Show
          Mark Plaksin added a comment - With 1.1.12, I get the same behavior as in the 11/Jan/13 5:28 AM update. Here's a sample success followed by the errors: {:timestamp=>"2013-05-08T14:35:39.396000-0400", :message=>"All plugins are started and registered.", :level=>:info} { "@source" => "eventlog://HAPPY/System", "@tags" => [], "@fields" => { "Category" => 0, "CategoryString" => nil, "ComputerName" => "HAPPY.jojo.com", "EventCode" => 7036, "EventIdentifier" => 1073748860, "EventType" => 3, "Logfile" => "System", "Message" => "The NSClient++ (x64) service entered the stopped state.", "RecordNumber" => 262939, "SourceName" => "Service Control Manager", "TimeGenerated" => "20130508183610.318806-000", "TimeWritten" => "20130508183610.318806-000", "Type" => "Information", "User" => nil, "InsertionStrings" => [ [0] "NSClient++ (x64)", [1] "stopped" ], "Data" => "N\x00S\x00C\x00l\x00i\x00e\x00n\x00t\x00p\x00p\x00/\x001\x00\x00\x00" }, "@type" => "Win32-EventLog", "@timestamp" => "2013-05-08T18:36:10-04:00", "@message" => "The NSClient++ (x64) service entered the stopped state." } {:timestamp=>"2013-05-08T14:38:03.600000-0400", :message=>"Windows Event Log error: IEnumVARIANT::Next\n[\"org.racob.com.EnumVariant.Next(Native Method)\", \"org.racob.com.EnumVariant.hasMoreElements(EnumVariant.java:47)\", \"org.jruby.ext.win32ole.RubyWIN32OLE.each(RubyWIN32OLE.java:64)\", \"org.jruby.ext.win32ole.RubyWIN32OLE$INVOKER$i$0$0$each.call(RubyWIN32OLE$INVOKER$i$0$0$each.gen)\", \"org.jruby.runtime.callsite.CachingCallSite.callBlock(CachingCallSite.java:143)\", \"org.jruby.runtime.callsite.CachingCallSite.callIter(CachingCallSite.java:154)\", \"org.jruby.ast.CallNoArgBlockNode.interpret(CallNoArgBlockNode.java:64)\", \"org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)\", \"org.jruby.ast.BlockNode.interpret(BlockNode.java:71)\", \"org.jruby.evaluator.ASTInterpreter.INTERPRET_BLOCK(ASTInterpreter.java:112)\", \"org.jruby.runtime.Interpreted19Block.evalBlockBody(Interpreted19Block.java:209)\", \"org.jruby.runtime.Interpreted19Block.yield(Interpreted19Block.java:160)\", \"org.jruby.runtime.Interpreted19Block.yieldSpecific(Interpreted19Block.java:133)\", \"org.jruby.runtime.Block.yieldSpecific(Block.java:99)\", \"org.jruby.RubyKernel.loop(RubyKernel.java:1409)\", \"org.jruby.RubyKernel$INVOKER$s$0$0$loop.call(RubyKernel$INVOKER$s$0$0$loop.gen)\", \"org.jruby.runtime.callsite.CachingCallSite.cacheAndCall(CachingCallSite.java:316)\", \"org.jruby.runtime.callsite.CachingCallSite.callBlock(CachingCallSite.java:145)\", \"org.jruby.runtime.callsite.CachingCallSite.callIter(CachingCallSite.java:154)\", \"org.jruby.ast.FCallNoArgBlockNode.interpret(FCallNoArgBlockNode.java:32)\", \"org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)\", \"org.jruby.ast.BlockNode.interpret(BlockNode.java:71)\", \"org.jruby.ast.RescueNode.executeBody(RescueNode.java:224)\", \"org.jruby.ast.RescueNode.interpret(RescueNode.java:119)\", \"org.jruby.ast.BeginNode.interpret(BeginNode.java:83)\", \"org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)\", \"org.jruby.ast.BlockNode.interpret(BlockNode.java:71)\", \"org.jruby.evaluator.ASTInterpreter.INTERPRET_METHOD(ASTInterpreter.java:75)\", \"org.jruby.internal.runtime.methods.InterpretedMethod.call(InterpretedMethod.java:182)\", \"org.jruby.internal.runtime.methods.DefaultMethod.call(DefaultMethod.java:188)\", \"org.jruby.runtime.callsite.CachingCallSite.cacheAndCall(CachingCallSite.java:326)\", \"org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:170)\", \"org.jruby.ast.CallOneArgNode.interpret(CallOneArgNode.java:57)\", \"org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)\", \"org.jruby.ast.BlockNode.interpret(BlockNode.java:71)\", \"org.jruby.ast.RescueNode.executeBody(RescueNode.java:224)\", \"org.jruby.ast.RescueNode.interpret(RescueNode.java:119)\", \"org.jruby.ast.BeginNode.interpret(BeginNode.java:83)\", \"org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)\", \"org.jruby.ast.WhileNode.interpret(WhileNode.java:131)\", \"org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)\", \"org.jruby.ast.BlockNode.interpret(BlockNode.java:71)\", \"org.jruby.evaluator.ASTInterpreter.INTERPRET_METHOD(ASTInterpreter.java:75)\", \"org.jruby.internal.runtime.methods.InterpretedMethod.call(InterpretedMethod.java:225)\", \"org.jruby.internal.runtime.methods.DefaultMethod.call(DefaultMethod.java:204)\", \"org.jruby.runtime.callsite.CachingCallSite.cacheAndCall(CachingCallSite.java:346)\", \"org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:204)\", \"org.jruby.ast.FCallSpecialArgNode.interpret(FCallSpecialArgNode.java:41)\", \"org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)\", \"org.jruby.evaluator.ASTInterpreter.INTERPRET_BLOCK(ASTInterpreter.java:112)\", \"org.jruby.runtime.Interpreted19Block.evalBlockBody(Interpreted19Block.java:209)\", \"org.jruby.runtime.Interpreted19Block.yield(Interpreted19Block.java:197)\", \"org.jruby.runtime.Interpreted19Block.call(Interpreted19Block.java:128)\", \"org.jruby.runtime.Block.call(Block.java:89)\", \"org.jruby.RubyProc.call(RubyProc.java:261)\", \"org.jruby.RubyProc.call(RubyProc.java:213)\", \"org.jruby.internal.runtime.RubyRunnable.run(RubyRunnable.java:98)\", \"java.lang.Thread.run(Unknown Source)\"]", :level=>:error} {:timestamp=>"2013-05-08T14:38:04.725000-0400", :message=>"Windows Event Log error: IEnumVARIANT::Next\n[\"org.racob.com.EnumVariant.Next(Native Method)\", \"org.racob.com.EnumVariant.hasMoreElements(EnumVariant.java:47)\", \"org.jruby.ext.win32ole.RubyWIN32OLE.each(RubyWIN32OLE.java:64)\", \"org.jruby.ext.win32ole.RubyWIN32OLE$INVOKER$i$0$0$each.call(RubyWIN32OLE$INVOKER$i$0$0$each.gen)\", \"org.jruby.runtime.callsite.CachingCallSite.callBlock(CachingCallSite.java:143)\", \"org.jruby.runtime.callsite.CachingCallSite.callIter(CachingCallSite.java:154)\", \"org.jruby.ast.CallNoArgBlockNode.interpret(CallNoArgBlockNode.java:64)\", \"org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)\", \"org.jruby.ast.BlockNode.interpret(BlockNode.java:71)\", \"org.jruby.evaluator.ASTInterpreter.INTERPRET_BLOCK(ASTInterpreter.java:112)\", \"org.jruby.runtime.Interpreted19Block.evalBlockBody(Interpreted19Block.java:209)\", \"org.jruby.runtime.Interpreted19Block.yield(Interpreted19Block.java:160)\", \"org.jruby.runtime.Interpreted19Block.yieldSpecific(Interpreted19Block.java:133)\", \"org.jruby.runtime.Block.yieldSpecific(Block.java:99)\", \"org.jruby.RubyKernel.loop(RubyKernel.java:1409)\", \"org.jruby.RubyKernel$INVOKER$s$0$0$loop.call(RubyKernel$INVOKER$s$0$0$loop.gen)\", \"org.jruby.runtime.callsite.CachingCallSite.callBlock(CachingCallSite.java:143)\", \"org.jruby.runtime.callsite.CachingCallSite.callIter(CachingCallSite.java:154)\", \"org.jruby.ast.FCallNoArgBlockNode.interpret(FCallNoArgBlockNode.java:32)\", \"org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)\", \"org.jruby.ast.BlockNode.interpret(BlockNode.java:71)\", \"org.jruby.ast.RescueNode.executeBody(RescueNode.java:224)\", \"org.jruby.ast.RescueNode.interpret(RescueNode.java:119)\", \"org.jruby.ast.BeginNode.interpret(BeginNode.java:83)\", \"org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)\", \"org.jruby.ast.BlockNode.interpret(BlockNode.java:71)\", \"org.jruby.evaluator.ASTInterpreter.INTERPRET_METHOD(ASTInterpreter.java:75)\", \"org.jruby.internal.runtime.methods.InterpretedMethod.call(InterpretedMethod.java:182)\", \"org.jruby.internal.runtime.methods.DefaultMethod.call(DefaultMethod.java:188)\", \"org.jruby.runtime.callsite.CachingCallSite.cacheAndCall(CachingCallSite.java:326)\", \"org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:170)\", \"org.jruby.ast.CallOneArgNode.interpret(CallOneArgNode.java:57)\", \"org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)\", \"org.jruby.ast.BlockNode.interpret(BlockNode.java:71)\", \"org.jruby.ast.RescueNode.executeBody(RescueNode.java:224)\", \"org.jruby.ast.RescueNode.interpret(RescueNode.java:119)\", \"org.jruby.ast.BeginNode.interpret(BeginNode.java:83)\", \"org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)\", \"org.jruby.ast.WhileNode.interpret(WhileNode.java:131)\", \"org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)\", \"org.jruby.ast.BlockNode.interpret(BlockNode.java:71)\", \"org.jruby.evaluator.ASTInterpreter.INTERPRET_METHOD(ASTInterpreter.java:75)\", \"org.jruby.internal.runtime.methods.InterpretedMethod.call(InterpretedMethod.java:225)\", \"org.jruby.internal.runtime.methods.DefaultMethod.call(DefaultMethod.java:204)\", \"org.jruby.runtime.callsite.CachingCallSite.cacheAndCall(CachingCallSite.java:346)\", \"org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:204)\", \"org.jruby.ast.FCallSpecialArgNode.interpret(FCallSpecialArgNode.java:41)\", \"org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)\", \"org.jruby.evaluator.ASTInterpreter.INTERPRET_BLOCK(ASTInterpreter.java:112)\", \"org.jruby.runtime.Interpreted19Block.evalBlockBody(Interpreted19Block.java:209)\", \"org.jruby.runtime.Interpreted19Block.yield(Interpreted19Block.java:197)\", \"org.jruby.runtime.Interpreted19Block.call(Interpreted19Block.java:128)\", \"org.jruby.runtime.Block.call(Block.java:89)\", \"org.jruby.RubyProc.call(RubyProc.java:261)\", \"org.jruby.RubyProc.call(RubyProc.java:213)\", \"org.jruby.internal.runtime.RubyRunnable.run(RubyRunnable.java:98)\", \"java.lang.Thread.run(Unknown Source)\"]", :level=>:error}
          Mark Plaksin made changes -
          Affects Version/s 1.1.12 [ 11020 ]
          Affects Version/s 1.1.1 [ 10221 ]
          Fix Version/s 1.1.10 [ 10820 ]
          Mark Plaksin made changes -
          Status Resolved [ 5 ] New [ 10000 ]
          Hide
          Mark Plaksin added a comment -

          This may not help but FWIW, if I reboot and then run Logstash, it lasts a tiny bit longer before it starts logging that error over and over. I saw maybe 5 eventlog events before the errors started.

          Show
          Mark Plaksin added a comment - This may not help but FWIW, if I reboot and then run Logstash, it lasts a tiny bit longer before it starts logging that error over and over. I saw maybe 5 eventlog events before the errors started.
          Jordan Sissel made changes -
          Status New [ 10000 ] Confirmed [ 10001 ]
          Hide
          Morgan Blackthorne added a comment -

          Still seeing this issue with 1.1.13; has the fix not been rolled out to that version yet, or is this a regression? If it hasn't been rolled out yet, any guidelines on building the Windows JAR from source? Thanks!

          Show
          Morgan Blackthorne added a comment - Still seeing this issue with 1.1.13; has the fix not been rolled out to that version yet, or is this a regression? If it hasn't been rolled out yet, any guidelines on building the Windows JAR from source? Thanks!
          Mark Plaksin made changes -
          Link This issue discovered while testing LOGSTASH-1214 [ LOGSTASH-1214 ]

            People

            • Assignee:
              Jordan Sissel
              Reporter:
              Derek Bradley
            • Votes:
              0 Vote for this issue
              Watchers:
              10 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved: