Describe the enhancement:
Currently if the Windows Event Log service is stopped, Winlogbeat will stop reading events from the channel. This is because we receive an error that the remote procedure call has been cancelled.
|
log.Errorf("Error occured while reading from Windows Event Log '%v': %v", source.Name(), err) |
Describe a specific use case for the enhancement or feature:
Preferred behavior is that Winlogbeat continue to read from the channel even if Windows Event Log Service is restarted.
Describe the enhancement:
Currently if the Windows Event Log service is stopped, Winlogbeat will stop reading events from the channel. This is because we receive an error that the remote procedure call has been cancelled.
beats/filebeat/input/winlog/input.go
Line 123 in ba9eebf
Describe a specific use case for the enhancement or feature:
Preferred behavior is that Winlogbeat continue to read from the channel even if Windows Event Log Service is restarted.