read_from_head does not work

[parishs73]

I have been trying to set this up on Windows 2016. when this is set, the agent starts and it doesn't send the logs, but it also doesn't 'stamp' the pos file with its log positions. when the agent is restarted it then sends all of the logs from the the start

Any ideas why this is?

[cosmo0920]

Could you tell which is your using windows EventLog plugin, in_windows_eventlog or in_windows_eventlog 2?

[parishs73]

<source>
  @type windows_eventlog2
  @id Solarwinds_eventlog2
  channels ["SolarWinds.Net","SWI Logs"]
  tag Solarwinds.winevt
  parse_description true
  <storage>
    @type local
    persistent false
    path C:\opt\td-agent\sw.pos2
  </storage>
</source>

[parishs73]

The storage.json file just contains:
{"swi logs":"\r\n","solarwinds.net":"\r\n"}

[cosmo0920]

persistent false should be no position stored.
To store EventLog positions, we should use persistent as true.

[parishs73]

Set that, deleted the storage.json and it is still not showing positions in it. Does there need to be something actively written to the log within a set time period?

[cosmo0920]

read_from_head requests long time to consume and write read positions. What the version do you use in_windows_eventlog2?

[parishs73]

the windows-eventlog plugin is 0.4.5, is that what you are meaning?

[cosmo0920]

read_from_head true and render_as_xml true(default value) will cause CPU usage spike and slow operation.
It takes long time to create valid bookmark stamp.

[parishs73]

I don't have render_as_xml set so it should default to true

[cosmo0920]

Hmm..., could you try to set render_as_xml as true?
The default value of render_as_xml should be true and this configuration is forcibly to use Ruby XML parser(nokogiri).
If render_as_xml is set up as false, the dependent gem try to map EventLog data to Ruby Hash object directly.
Ruby XML parser implementation, which is using nokogiri, is slower than direct Ruby Hash object mapping.

NOTE: When render_as_xml as false, the dependent winevt_c gem renders Windows EventLog as Ruby Hash object directly. This reduces bottleneck to consume EventLog. Specifying render_as_xml as false should be faster consuming than render_as_xml as true case.