Koji Kawamura created NIFI-6507:
-----------------------------------
Summary: ConsumeWindowsEventLog should renew failed subscription
Key: NIFI-6507
URL: https://issues.apache.org/jira/browse/NIFI-6507
Project: Apache NiFi
Issue Type: Bug
Components: Extensions
Reporter: Koji Kawamura
Assignee: Koji Kawamura
Current implementation has some code for specific 15011 error code. The
processor uses EvtSubscribeStrict flag which produces
ERROR_EVT_QUERY_RESULT_STALE (15011) event when event records are missing.
Currently, the processor only logs the error code. But does not renew
subscription.
[https://docs.microsoft.com/en-us/windows/desktop/api/winevt/nc-winevt-evt_subscribe_callback]
When error 15011 happens, the processor stopped reading further events. It
looks as if the processor hangs. The processor doesn't renew subscription
because it thinks it already has a valid subscription. The current
implementation determines if a subscription is valid by these lines of code:
{code:java}
private boolean isSubscribed() {
return subscriptionHandle != null && subscriptionHandle.getPointer() !=
null;
}{code}
[https://github.com/apache/nifi/blob/master/nifi-nar-bundles/nifi-windows-event-log-bundle/nifi-windows-event-log-processors/src/main/java/org/apache/nifi/processors/windows/event/log/ConsumeWindowsEventLog.java#L242-L244]
If already subscribed, the processor polls received messages from the internal
queue. But since the subscription has encountered an error, no further messages
available.
--
This message was sent by Atlassian JIRA
(v7.6.14#76016)
