We have observed that the Alloy Agent is creating multiple bookmark files for the windows events logs:-application, system, and security logs on nearly all our servers. This behavior seems unusual and is leading to the creation of redundant bookmark files.
below are the one sample alloy bookmark job:-
loki.source.windowsevent “logs_default_WinEventSys” {
eventlog_name = “System”
bookmark_path = “XX:\Program Files\Grafana Agent Flow\bookmark_sys.xml”
poll_interval = “0s”
use_incoming_timestamp = true
forward_to = [loki.write.logs_default.receiver]
labels = {
host = “Hostname”,
job = “WinEventSys”,
}
}