The windowseventlogreceiver currently builds a single query for all event log channels it follows. That means the receiver uses a single bookmark to track record offsets. We observed bookmarks with wrong record offsets, which then invalidate the offsets for all followed channels.
The single query is also problematic when the list of followed channels changes.
Two options:
- Configure one receiver per channel
- Extend the receiver to start one event log follower per channel
We also need to figure out what happens to old bookmarks. Example: remove a channel from the configuration and add it back one month later. Does the old bookmark still exist, and should we start reading from it?
The
windowseventlogreceivercurrently builds a single query for all event log channels it follows. That means the receiver uses a single bookmark to track record offsets. We observed bookmarks with wrong record offsets, which then invalidate the offsets for all followed channels.The single query is also problematic when the list of followed channels changes.
Two options:
We also need to figure out what happens to old bookmarks. Example: remove a channel from the configuration and add it back one month later. Does the old bookmark still exist, and should we start reading from it?