Error in the Windows Event Log (application) during restarting the FluentBit service.

[mpopej]

Describe the bug

When the FluentBit service is restarted, the application error log is generated in the Windows Event Logs. The error is generated only when "outputs/syslog-1.yml" configuration file is uncommented in the main FluentBit config (all configs in the screenshots section). I noticed that mentioned error is generated when the service is trying to stop (longer service stopping time). After a while, new instance of the FluentBit process starting successfully without any issues and all events are forwarded to the server.

To Reproduce

1. Set the default config file in the registry as below:
   "C:\Program Files\fluent-bit\bin\fluent-bit.exe" -c "C:\Program Files\fluent-bit\conf\test-default.yml"

2. Create test-default.yml file in the FluentBit conf folder:

3. Edit inputs/base.yml file as below:

4. Edit outputs/syslog-1.yml file as below:

(Any Syslog server is up and running on the localhost and 514 port)

5. Restart the fluent-bit service twice

6. Error log appears

• Example log message if applicable:

[2024/11/26 15:19:00] [debug] [input:winevtlog:winevtlog.0] read 173672 bytes from 'Security'
[2024/11/26 15:19:00] [debug] [task] created task=00000186CEF41000 id=0 OK
[2024/11/26 15:19:00] [debug] [out flush] cb_destroy coro_id=2
[2024/11/26 15:19:00] [debug] [task] destroy task=00000186CEF41000 (task_id=0)
[2024/11/26 15:19:03] [debug] [input:winevtlog:winevtlog.0] read 524872 bytes from 'Security'
[2024/11/26 15:19:03] [debug] [task] created task=00000186CEF409C0 id=0 OK
[2024/11/26 15:19:03] [debug] [out flush] cb_destroy coro_id=3
[2024/11/26 15:19:03] [debug] [task] destroy task=00000186CEF409C0 (task_id=0)
[2024/11/26 15:19:06] [debug] [input:winevtlog:winevtlog.0] read 117408 bytes from 'Security'
[2024/11/26 15:19:06] [debug] [task] created task=00000186CEF406A0 id=0 OK
[2024/11/26 15:19:06] [debug] [out flush] cb_destroy coro_id=4
[2024/11/26 15:19:06] [debug] [task] destroy task=00000186CEF406A0 (task_id=0)
[2024/11/26 15:19:09] [debug] [input:winevtlog:winevtlog.0] read 338408 bytes from 'Security'
[2024/11/26 15:19:09] [debug] [task] created task=00000186CEF406A0 id=0 OK
[2024/11/26 15:19:09] [debug] [out flush] cb_destroy coro_id=5
[2024/11/26 15:19:09] [debug] [task] destroy task=00000186CEF406A0 (task_id=0)
[2024/11/26 15:19:12] [debug] [input:winevtlog:winevtlog.0] read 332656 bytes from 'Security'
[2024/11/26 15:19:12] [debug] [task] created task=00000186CEF40420 id=0 OK
[2024/11/26 15:19:12] [debug] [out flush] cb_destroy coro_id=6
[2024/11/26 15:19:12] [debug] [task] destroy task=00000186CEF40420 (task_id=0)
[2024/11/26 15:19:15] [debug] [input:winevtlog:winevtlog.0] read 269016 bytes from 'Security'
[2024/11/26 15:19:15] [debug] [input:winevtlog:winevtlog.0] read 1328 bytes from 'System'
[2024/11/26 15:19:15] [debug] [task] created task=00000186CEF40420 id=0 OK
[2024/11/26 15:19:15] [debug] [out flush] cb_destroy coro_id=7
[2024/11/26 15:19:15] [debug] [task] destroy task=00000186CEF40420 (task_id=0)

Expected behavior
Restart service without any errors

Screenshots

test-default.yaml:

syslog-1.yaml:

base.yaml:

Error1:

Error2:

Your Environment
Windows 10 / Windows Server 2019

• Version used: 3.1.4.0 / 3.2.2.0
• Filters and plugins: No filters / plugins using to reproduce the issue

[mpopej]

Same problem observed on the 3.2.2.0 version