Shulou(Shulou.com)06/01 Report--

Windows server restart led to filebeat can not start what to do, many novices are not very clear about this, in order to help you solve this problem, the following editor will explain in detail for you, people with this need can come to learn, I hope you can gain something.

At 6: 00 in the morning, I received an alarm from zabbix that a server had restarted. I immediately checked the system log when I returned to the company and found that there were only these records:

This is a joke! It must have been an accidental closure, but why did it close accidentally?

This issue needs to be followed up and will not be discussed for the time being, because there is a more urgent failure to deal with: filebeat cannot be started.

Since the system cannot be started, let's go to the service management and try it out:

Run-enter services.msc

After finding the service of filebeat, the manual startup failed and got an error:

After searching on Google, we found a solution:

My computer-- > right-click-- > manage-- > Local users and groups; Select groups-- > double-click Administrators-- > Click "add"-- > Click "Advanced"-- > Click "find now"-- > Select Network Service users in the list below-> click OK-- > join

But it is of no use to go to the root directory of filebeat, try to run filebeat.exe manually, and find that it can be executed, which means that there is no problem with the program, so it is suspected that the restart of the machine caused the service management to report an error, so you try to reinstall the filebeat service, but the service startup still fails.

Check the log of filebeat and find that there is an error:

Error decoding old state: invalid character'\ x00' looking for beginning of value

The main idea is: when decoding the old state, there is an invalid character'\ x00', which is very similar to the error of json parsing failure! Does this have anything to do with json?

This json must have nothing to do with the json of the log, it should be related to some configuration json, but there are not many configurations that will change, that should be the configuration that stores the offset of the record file: registery.

So check the registery below in the data directory of the root directory. Old and registery, but they are both normal json files, and there is no so-called'\ x00', which is embarrassing..

Considering that manual execution is fine, but startup through the service manager fails, is it due to the wrong posture in the startup mode? Before it is too late, copy the way the server starts: filebeat- right attribute-the path to the executable file

Run under the dark CMD window:

Although we got the same error report, we seem to find that there is a problem.-path.data "c"\\ ProgramData\\ filebeat ". This directory should be the directory where the file offset is stored, but why not the root directory of filebeat?

Can it be said that this is the default when the service is registered? That may be the problem of the json file is here, so go directly to the directory to check, there is really a registry file, open with notepadd++, and finally found the reason:

The contents of the files are all garbled, and the reason should be that the system shuts down abnormally and the program does not exit normally, resulting in garbled writing, which makes it impossible to parse when filbeat is re-read.

After deleting the file, filebeat starts normally! This troubleshooting is over for the time being, thank you.

Is it helpful for you to read the above content? If you want to know more about the relevant knowledge or read more related articles, please follow the industry information channel, thank you for your support.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.