fluent/fluent-plugin-windows-eventlog

Library names injected if message not found in the message table

project0 opened this issue · 3 comments

project0 commented

Note sure where is it coming from, but i see the library names only when the event log has no proper description.
I am using the eventlog2 plugin.

"DescriptionTitle": "The message resource is present but the message was not found in the message table.\r\n0.4.6/fluent/plugin/parser_winevt_xml.so"
"DescriptionTitle": "The message resource is present but the message was not found in the message table.\r\nib/fluent/plugin/in_windows_eventlog2.rb",
"EventData": [
  "C:\\ProgramData\\Datadog\\datadog.yaml seems to contain a valid configuration, not overwriting config"
],
cosmo0920 commented

This is because message resource is not installed properly.
This phenomenon is also observed in Windows' event log viewer.
This is plugin limitation.

see:

NOTE: When Description contains error message such as The message resource is present but the message was not found in the message table., eventlog's resource file (.mui) related to error generating event is something wrong. This issue is also occurred in built-in Windows Event Viewer which is the part of Windows management tool.

project0 commented

sorry, but i am not alking about the message itself, its regarding the injected libary name in the message: r\n0.4.6/fluent/plugin/parser_winevt_xml.so.

cosmo0920 commented

Strictly speaking, we just use EvtFormatMessage to obtain events's Description.
This library name log glitch is caused by this Windows API....
We cannot fix it.