Skip to content

fix(windows_event_log): soft bookmark resume before future-events fallback - #26125

Open
VedantMadane wants to merge 2 commits into
vectordotdev:masterfrom
VedantMadane:fix-wel-soft-bookmark-resubscribe-26120
Open

fix(windows_event_log): soft bookmark resume before future-events fallback#26125
VedantMadane wants to merge 2 commits into
vectordotdev:masterfrom
VedantMadane:fix-wel-soft-bookmark-resubscribe-26120

Conversation

@VedantMadane

Copy link
Copy Markdown

Summary

Fixes #26120.

When strict EvtSubscribeStartAfterBookmark|Strict fails (e.g. ERROR_NOT_FOUND), the previous path fell straight through to EvtSubscribeToFutureEvents when read_existing_events = false, dropping events between the last bookmark and now.

Insert a soft bookmark resume (StartAfterBookmark without Strict) before the last-resort future/oldest flags so recovery prefers continuity over a hard reset. Some re-delivery is possible; silent loss is not.

Test plan

  • Windows wevtapi integration (CI / local Windows)
  • Change localized to resubscribe_channel

@VedantMadane
VedantMadane requested a review from a team as a code owner August 17, 2026 10:49
@github-actions github-actions Bot added the domain: sources Anything related to the Vector's sources label Aug 17, 2026
@github-actions

github-actions Bot commented Aug 17, 2026

Copy link
Copy Markdown
Contributor

All contributors have signed the CLA ✍️ ✅
Posted by the CLA Assistant Lite bot.

@VedantMadane
VedantMadane force-pushed the fix-wel-soft-bookmark-resubscribe-26120 branch from 75ad7da to 86ba467 Compare August 17, 2026 10:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

domain: sources Anything related to the Vector's sources

Projects

None yet

1 participant