Recover from error 87 if found (#39781)

elastic · Jun 3, 2024 · d535d17 · d535d17
1 parent 074c1dd
commit d535d17
Show file tree

Hide file tree

Showing 3 changed files with 5 additions and 1 deletion.
diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
@@ -331,6 +331,7 @@ https://github.com/elastic/beats/compare/v8.8.1\...main[Check the HEAD diff]
 *Winlogbeat*
 
 - Use fixed size buffer at first pass for event parsing, improving throughput {issue}39530[39530] {pull}39544[39544]
+- Add ERROR_INVALID_PARAMETER to the list of recoverable errors. {pull}39781[39781]
 
 *Functionbeat*
 

diff --git a/winlogbeat/eventlog/errors_windows.go b/winlogbeat/eventlog/errors_windows.go
@@ -29,7 +29,9 @@ import (
 //
 //nolint:errorlint // These are never wrapped.
 func IsRecoverable(err error) bool {
-	return err == win.ERROR_INVALID_HANDLE || err == win.RPC_S_SERVER_UNAVAILABLE || err == win.RPC_S_CALL_CANCELLED || err == win.ERROR_EVT_QUERY_RESULT_STALE
+	return err == win.ERROR_INVALID_HANDLE || err == win.RPC_S_SERVER_UNAVAILABLE ||
+		err == win.RPC_S_CALL_CANCELLED || err == win.ERROR_EVT_QUERY_RESULT_STALE ||
+		err == win.ERROR_INVALID_PARAMETER
 }
 
 // IsChannelNotFound returns true if the error indicates the channel was not found.

diff --git a/winlogbeat/sys/wineventlog/syscall_windows.go b/winlogbeat/sys/wineventlog/syscall_windows.go
@@ -41,6 +41,7 @@ const NilHandle EvtHandle = 0
 // https://msdn.microsoft.com/en-us/library/windows/desktop/ms681382(v=vs.85).aspx
 const (
 	ERROR_INVALID_HANDLE        syscall.Errno = 6
+	ERROR_INVALID_PARAMETER     syscall.Errno = 87
 	ERROR_INSUFFICIENT_BUFFER   syscall.Errno = 122
 	ERROR_NO_MORE_ITEMS         syscall.Errno = 259
 	RPC_S_SERVER_UNAVAILABLE    syscall.Errno = 1722