Agent will fail to start if windows_events.bookmark_path file is truncated

[nazar554]

I'm using windows_events together with bookmark_path to gather Event logs on Windows.
If the host system is shut down incorrectly (power outage, BSOD, etc...), the bookmark.xml file can get truncated.
Because it's invalid Grafana Agent service will fail to start until I remove the file manually.

Can the agent flush the bookmark file to disk from time to time? Or use a SQLite db instead of an .xml file?
And is there a workaround to ignore truncated/corrupted bookmarks during startup?

[mattdurham]

Using something more solid than .xml file seems pretty reasonable. This change would need to proliferate to our Loki team, they seem to have an issue open for it grafana/loki#6213.

[quicoli]

I just stumbled on this today. I had to remove the Windows logs from my configuration file 😕

[mhixon4479]

Still seeing this in 0.38.x

[mattdurham]

Is this using static mode or flow mode? Due to how we package static mode it did not get the changes that allow a more robust file.

[nazar554]

Is this using static mode or flow mode? Due to how we package static mode it did not get the changes that allow a more robust file.

static mode

[mhixon4479]

static here, too - but we've seen the same behavior in flow mode - in both cases on Windows.

[mattdurham]

If you have seen it in flow on 38.x and able to share logs would love to see them, if you want to pass them in the grafana community slack.

[ricotek]

also seeing this on random windows hosts all are using 38.1 static mode

[mattdurham]

The fix was only applied to flow mode. Since flow is consuming promtail functionality its unlikely we will back port to static mode.

[gmazuel]

I received

|Application | Grafana Agent | level=error msg="error creating the agent server entrypoint" err="unable to apply config for integrations: unable to create logs instance: failed to make windows target manager: failed to create bookmark using path=./bookmarks-sys.xml: invalid argument"

bookmarks-sys.xml is empty , change name and agent start

[rfratto]

Hi there 👋

On April 9, 2024, Grafana Labs announced Grafana Alloy, the spirital successor to Grafana Agent and the final form of Grafana Agent flow mode. As a result, Grafana Agent has been deprecated and will only be receiving bug and security fixes until its end-of-life around November 1, 2025.

To make things easier for maintainers, we're in the process of migrating all issues tagged variant/flow to the Grafana Alloy repository to have a single home for tracking issues. This issue is likely something we'll want to address in both Grafana Alloy and Grafana Agent, so just because it's being moved doesn't mean we won't address the issue in Grafana Agent :)