collector icon indicating copy to clipboard operation
collector copied to clipboard

Support new Windows EventLog API

Open bernd opened this issue 8 years ago • 1 comments

Windows has a new EventLog API since Vista / Server 2008. The library we are using the read the event log (sigar) does not support the new API yet.

We have to find another library that supports reading the from the new API to be able to read the new eventlog types correctly.

  • [ ] Make sure the eventlog reader can handle manual eventlog deletion/cleaning. The current sigar based reader throws an exception in that case. (2015-09-03T08:17:27.431+0200 ERROR [EventLogThread] sigar.win32.EventLogThread - Unable to read event id 250667: org.hyperic.sigar.win32.Win32Exception: Error reading from the event log: 1503)
  • [ ] Save the current state for each followed eventlog stream and start reading from that position after a restart to avoid losing logs.

bernd avatar Sep 02 '15 16:09 bernd