Hi, you can try to figure out why winlogbeat is crashing by calling it the same cmd window. With '.\winlogbeat.exe -c generated\winlogbeat.yml' it should tell you what the problem is. Maybe also posting the generated config file could help to debug this.
Cheers, Marius On 14 December 2016 at 17:31, CSG <[email protected]> wrote: > I have installed Graylog Appliance v2.1 (1st machine) , > i have installed graylog_collector_sidecar.exe on a Windows 2008 R2 (2nd > machine), i have not installed winlogbeat.exe as it is embedded into the > graylog directory > > communication is established between both machines > > I have configured an input and output on a configuration linked to the > Windows and iis tags (tags found in graylog_collector_sidecar.yml file) > > Graylogserver can see this collector > > When i run graylog_collector_sidecar.exe in a cmd for debug purpose, i can > see that winlogbeat keeps on starting, then crashing with those logs : > > > msg="[Winlogbeat] Starting <exec driver>" > msg="[Winlogbeat] Configuration change detected, rewriting configuration > file" > msg="[Winlogbeat] Stopping" > msg="[Winlogbeat] Backend crashed, trying to restart 1/3" > .... > msg="[Winlogbeat] Unable to start collector after 3 tries, giving up" > msg="[Winlogbeat] Starting <exec driver>" > > On Graylog Appliance : > - status of this collector loops between Running and Failing > > how can i avoid these never ending crash ? > > -- > You received this message because you are subscribed to the Google Groups > "Graylog Users" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > To view this discussion on the web visit > https://groups.google.com/d/msgid/graylog2/5e29b838-ee8d-4e5b-93f5-cb3baaca337c%40googlegroups.com. > For more options, visit https://groups.google.com/d/optout. -- Developer Tel.: +49 (0)40 609 452 077 Fax.: +49 (0)40 609 452 078 TORCH GmbH - A Graylog Company Poolstraße 21 20335 Hamburg Germany https://www.graylog.com Commercial Reg. (Registergericht): Amtsgericht Hamburg, HRB 125175 Geschäftsführer: Lennart Koopmann (CEO) -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/CAMqbBbK_uH7B9JMQCBekc1FJpWnfKSkiFyaCL1otGE6k8kuyOQ%40mail.gmail.com. For more options, visit https://groups.google.com/d/optout.
