Grafana Agent for Windows Logging: `bookmark_path` invalid argument error

[aditya-opsverse]

Discussed in https://github.com/grafana/agent/discussions/5291

^{Originally posted by aditya-opsverse September 25, 2023}

Describe the bug I am trying to use the Grafana Agent for Windows to monitor the metrics and logs for some Windows Server 2016 Datacenter machines. Some of the servers are facing the invalid argument error for bookmark_path.

The configuration on all of the servers is the same. This issue comes up intermittently on some machines after the services have run for some time.

Issue: When using the bookmark_path key in the Windows event logging configuration file as described in the Grafana documentation, the system throws the following error:

Error Message:

level=error msg="error creating the agent server entrypoint" err="unable to apply config for windows-var-log: unable to create logs instance: failed to make windows target manager: failed to create bookmark using path=C:\\Program Files\\Grafana Agent\\bookmark.xml: invalid argument"

Config: agent-config.yaml

prometheus:
  global:
    scrape_interval: 30s
  wal_directory: C:\ProgramData\grafana-agent-wal
  configs:
    - name: default
      scrape_configs:
        - job_name: integrations/windows-exporter
          static_configs:
          - targets: ['127.0.0.1:9182']
          relabel_configs:
            - source_labels: [__address__]
              regex: '.*'
              target_label: instance
              replacement: <host>
      remote_write:
        - url: <url>
          basic_auth:
            username: <username>
            password: <password>

loki:
  positions_directory: C:\ProgramData\grafana-agent-wal
  configs:
    - name: windows-var-log
      clients:
        - url: <url>
          basic_auth:
            username: <username>
            password: <password>
      scrape_configs:
        - job_name: windows-var-log
          static_configs:
            - labels:
                job: windows-var-log
                host: <host>
        - job_name: windows
          windows_events:
            use_incoming_timestamp: false
            bookmark_path: "C:\\Program Files\\Grafana Agent\\bookmark.xml"
            eventlog_name: "Application"
            xpath_query: '*'
            labels:
              job: windows-events
          relabel_configs:
            - source_labels: ['computer']
              target_label: 'host'

Desired Outcome: The metrics and logs should be accessible on Grafana without any errors related to the bookmark_path argument.

Environment:

Windows Server 2016 Datacenter

[tpaschalis]

Thanks for the report; this sounds like a duplicate of grafana/alloy#516. As far as we've seen, this is likely coming from Agents that have crashed and lead to the bookmark_path being truncated.

Let me know if there's any more details you'd like to add, otherwise I'll close this as a dupe so we can track progress in a single issue.

[github-actions[bot]]

This issue has not had any activity in the past 30 days, so the needs-attention label has been added to it. If the opened issue is a bug, check to see if a newer release fixed your issue. If it is no longer relevant, please feel free to close this issue. The needs-attention label signals to maintainers that something has fallen through the cracks. No action is needed by you; your issue will be kept open and you do not have to respond to this comment. The label will be removed the next time this job runs if there is new activity. Thank you for your contributions!

[rfratto]

Hi there :wave:

On April 9, 2024, Grafana Labs announced Grafana Alloy, the spirital successor to Grafana Agent and the final form of Grafana Agent flow mode. As a result, Grafana Agent has been deprecated and will only be receiving bug and security fixes until its end-of-life around November 1, 2025.

To make things easier for maintainers, we're in the process of migrating all issues tagged variant/flow to the Grafana Alloy repository to have a single home for tracking issues. This issue is likely something we'll want to address in both Grafana Alloy and Grafana Agent, so just because it's being moved doesn't mean we won't address the issue in Grafana Agent :)