Windows Events receiver is starting to collect logs from beginning after restarting the machine

[saikalyan-bhagavathula]

Component(s)

receiver/windowseventlog

What happened?

Description

Try to collect few windows event logs by providing start_at: beginning. After collecting few logs, restart the machine and run the opentelemetry with same configuration. You can see same logs were collected which we got before restarted the machine.

Steps to Reproduce

• Start the opentelemetry with basic configuration provided below.
• After it collected the logs you can stop the opentelemetry.
• Try to restart the opentelemetry service.

Expected Result

• Only need to collect the events that are generated after we stop the opentlemetry.

Actual Result

• As the configuration have start_at: beginning it again collecting it from beginning.

Collector version

1.0.109

Environment information

Environment

OS: ("Windows 2022")
Compiler: (n/a)

OpenTelemetry Collector configuration

receivers:
  windowseventlog:
    channel: application
    start_at: "beginning"
exporters:
  debug:
    verbosity: detailed
service:
  pipelines:
    logs:
      receivers: [windowseventlog]
      exporters: [debug]

Log output

No response

Additional context

I think the issue here we are using context while getting the windows events, but that context will be dead once we stop the opentelemtry. so, it is trying to fetch events from starting again once we restart.

[github-actions]

Pinging code owners:

• receiver/windowseventlog: @armstrmi @pjanotti

See Adding Labels via Comments if you do not have permissions to add labels yourself.

[VihasMakwana]

@saikalyan-bhagavathula Thanks for filing this issue.

By default, windowseventlog stores the offset in memory. As a result, when you restart the collector, you observe that data is duplicated.

You can avoid this by using file_storage extension and add storage under windowseventlog. Read more about storage here.

---

Your new config would look something like:

receivers:
  windowseventlog:
    channel: application
    start_at: "beginning"
    storage: file_storage
exporters:
  debug:
    verbosity: detailed
extensions:
  file_storage:
    directory: /path/to/directory
service:
  extensions: [file_storage]
  pipelines:
    logs:
      receivers: [windowseventlog]
      exporters: [debug]

[pjanotti]

/label os:windows

[pjanotti]

Given that this is documented behavior of the receiver we should close this one.