Graylog Collector - Unable to read event

[taylorn-ai]

I have noticed this issue on one server in particular. It seems this error (below) occurs shortly after the collector service is started, and fills the STDOUT log (40GB +). Restarting the Collector resolves the issue - but I can't just restart the collector every 1-2 hours.

2016-02-01T19:26:51.150+1000 ERROR [EventLogThread] sigar.win32.EventLogThread - Unable to read event id 86995497: org.hyperic.sigar.win32.Win32Exception: Error reading from the event log: 1503
2016-02-01T19:26:51.151+1000 ERROR [EventLogThread] sigar.win32.EventLogThread - Unable to read event id 86995498: org.hyperic.sigar.win32.Win32Exception: Error reading from the event log: 1503
2016-02-01T19:26:51.151+1000 ERROR [EventLogThread] sigar.win32.EventLogThread - Unable to read event id 86995499: org.hyperic.sigar.win32.Win32Exception: Error reading from the event log: 1503
2016-02-01T19:26:51.151+1000 ERROR [EventLogThread] sigar.win32.EventLogThread - Unable to read event id 86995500: org.hyperic.sigar.win32.Win32Exception: Error reading from the event log: 1503
2016-02-01T19:26:51.152+1000 ERROR [EventLogThread] sigar.win32.EventLogThread - Unable to read event id 86995501: org.hyperic.sigar.win32.Win32Exception: Error reading from the event log: 1503
2016-02-01T19:26:51.152+1000 ERROR [EventLogThread] sigar.win32.EventLogThread - Unable to read event id 86995502: org.hyperic.sigar.win32.Win32Exception: Error reading from the event log: 1503
2016-02-01T19:26:51.152+1000 ERROR [EventLogThread] sigar.win32.EventLogThread - Unable to read event id 86995503: org.hyperic.sigar.win32.Win32Exception: Error reading from the event log: 1503
2016-02-01T19:26:51.152+1000 ERROR [EventLogThread] sigar.win32.EventLogThread - Unable to read event id 86995504: org.hyperic.sigar.win32.Win32Exception: Error reading from the event log: 1503
2016-02-01T19:26:59.153+1000 ERROR [EventLogThread] sigar.win32.EventLogThread - Unable to read event id 86995505: org.hyperic.sigar.win32.Win32Exception: Error reading from the event log: 1503
2016-02-01T19:26:59.153+1000 ERROR [EventLogThread] sigar.win32.EventLogThread - Unable to read event id 86995506: org.hyperic.sigar.win32.Win32Exception: Error reading from the event log: 1503
2016-02-01T19:27:01.157+1000 ERROR [EventLogThread] sigar.win32.EventLogThread - Unable to read event id 86995507: org.hyperic.sigar.win32.Win32Exception: Error reading from the event log: 1503
2016-02-01T19:27:01.157+1000 ERROR [EventLogThread] sigar.win32.EventLogThread - Unable to read event id 86995508: org.hyperic.sigar.win32.Win32Exception: Error reading from the event log: 1503
2016-02-01T19:27:01.158+1000 ERROR [EventLogThread] sigar.win32.EventLogThread - Unable to read event id 86995509: org.hyperic.sigar.win32.Win32Exception: Error reading from the event log: 1503
2016-02-01T19:27:01.158+1000 ERROR [EventLogThread] sigar.win32.EventLogThread - Unable to read event id 86995510: org.hyperic.sigar.win32.Win32Exception: Error reading from the event log: 1503
2016-02-01T19:27:07.159+1000 ERROR [EventLogThread] sigar.win32.EventLogThread - Unable to read event id 86995511: org.hyperic.sigar.win32.Win32Exception: Error reading from the event log: 1503
2016-02-01T19:27:07.159+1000 ERROR [EventLogThread] sigar.win32.EventLogThread - Unable to read event id 86995512: org.hyperic.sigar.win32.Win32Exception: Error reading from the event log: 1503
2016-02-01T19:27:11.159+1000 ERROR [EventLogThread] sigar.win32.EventLogThread - Unable to read event id 86995513: org.hyperic.sigar.win32.Win32Exception: Error reading from the event log: 1503
2016-02-01T19:27:11.159+1000 ERROR [EventLogThread] sigar.win32.EventLogThread - Unable to read event id 86995514: org.hyperic.sigar.win32.Win32Exception: Error reading from the event log: 1503
2016-02-01T19:27:11.160+1000 ERROR [EventLogThread] sigar.win32.EventLogThread - Unable to read event id 86995515: org.hyperic.sigar.win32.Win32Exception: Error reading from the event log: 1503
2016-02-01T19:27:11.160+1000 ERROR [EventLogThread] sigar.win32.EventLogThread - Unable to read event id 86995516: org.hyperic.sigar.win32.Win32Exception: Error reading from the event log: 1503
2016-02-01T19:27:11.160+1000 ERROR [EventLogThread] sigar.win32.EventLogThread - Unable to read event id 86995517: org.hyperic.sigar.win32.Win32Exception: Error reading from the event log: 1503
2016-02-01T19:27:11.160+1000 ERROR [EventLogThread] sigar.win32.EventLogThread - Unable to read event id 86995518: org.hyperic.sigar.win32.Win32Exception: Error reading from the event log: 1503

[joschi]

@TaylorRNelson Thanks for reporting this. Which exact version of Windows are you using?

The SIGAR library being used by the Graylog Collector unfortunately only supports older versions of the Windows Eventlog properly (see #57).
As a workaround (well, sort of) you could use nxlog to collect Windows Eventlog data (see https://nxlog.co/docs/nxlog-ce/nxlog-reference-manual.html#im_msvistalog).