From 7050f210b51e6de012ce857896738801cbacd8be Mon Sep 17 00:00:00 2001
From: Marc Guasch <marc.guasch@elastic.co>
Date: Tue, 31 Dec 2024 08:00:52 -0800
Subject: [PATCH] Retry on publisher disabled error

---
 winlogbeat/eventlog/errors_windows.go         |  2 +-
 winlogbeat/sys/wineventlog/syscall_windows.go | 19 ++++++++++---------
 2 files changed, 11 insertions(+), 10 deletions(-)

diff --git a/winlogbeat/eventlog/errors_windows.go b/winlogbeat/eventlog/errors_windows.go
index 1a8512c6ee4d..cec248bdde0d 100644
--- a/winlogbeat/eventlog/errors_windows.go
+++ b/winlogbeat/eventlog/errors_windows.go
@@ -31,7 +31,7 @@ import (
 func IsRecoverable(err error) bool {
 	return err == win.ERROR_INVALID_HANDLE || err == win.RPC_S_SERVER_UNAVAILABLE ||
 		err == win.RPC_S_CALL_CANCELLED || err == win.ERROR_EVT_QUERY_RESULT_STALE ||
-		err == win.ERROR_INVALID_PARAMETER
+		err == win.ERROR_INVALID_PARAMETER || err == win.ERROR_EVT_PUBLISHER_DISABLED
 }
 
 // IsChannelNotFound returns true if the error indicates the channel was not found.
diff --git a/winlogbeat/sys/wineventlog/syscall_windows.go b/winlogbeat/sys/wineventlog/syscall_windows.go
index 2dde1329e6b5..45ee740b420e 100644
--- a/winlogbeat/sys/wineventlog/syscall_windows.go
+++ b/winlogbeat/sys/wineventlog/syscall_windows.go
@@ -40,15 +40,16 @@ const NilHandle EvtHandle = 0
 // Event log error codes.
 // https://msdn.microsoft.com/en-us/library/windows/desktop/ms681382(v=vs.85).aspx
 const (
-	ERROR_INVALID_HANDLE        syscall.Errno = 6
-	ERROR_INVALID_PARAMETER     syscall.Errno = 87
-	ERROR_INSUFFICIENT_BUFFER   syscall.Errno = 122
-	ERROR_NO_MORE_ITEMS         syscall.Errno = 259
-	RPC_S_SERVER_UNAVAILABLE    syscall.Errno = 1722
-	RPC_S_INVALID_BOUND         syscall.Errno = 1734
-	RPC_S_CALL_CANCELLED        syscall.Errno = 1818
-	ERROR_INVALID_OPERATION     syscall.Errno = 4317
-	ERROR_EVT_CHANNEL_NOT_FOUND syscall.Errno = 15007
+	ERROR_INVALID_HANDLE         syscall.Errno = 6
+	ERROR_INVALID_PARAMETER      syscall.Errno = 87
+	ERROR_INSUFFICIENT_BUFFER    syscall.Errno = 122
+	ERROR_NO_MORE_ITEMS          syscall.Errno = 259
+	RPC_S_SERVER_UNAVAILABLE     syscall.Errno = 1722
+	RPC_S_INVALID_BOUND          syscall.Errno = 1734
+	RPC_S_CALL_CANCELLED         syscall.Errno = 1818
+	ERROR_INVALID_OPERATION      syscall.Errno = 4317
+	ERROR_EVT_CHANNEL_NOT_FOUND  syscall.Errno = 15007
+	ERROR_EVT_PUBLISHER_DISABLED syscall.Errno = 15037
 )
 
 // EvtSubscribeFlag defines the possible values that specify when to start subscribing to events.