[pkg/stanza] Windows input operator should resubscribe when remote host restarts

.chloggen/stanza-windows-remote-resubscribe.yaml

@@ -0,0 +1,27 @@
+# Use this changelog template to create an entry for release notes.
+
+# One of 'breaking', 'deprecation', 'new_component', 'enhancement', 'bug_fix'
+change_type: "bug_fix"
+
+# The name of the component, or a single word describing the area of concern, (e.g. filelogreceiver)
+component: windowseventlogreceiver
+
+# A brief description of the change.  Surround your text with quotes ("") if it needs to start with a backtick (`).
+note: If collecting from a remote host, the receiver will stop collecting if the host restarts. This change resubscribes when the host restarts.
+
+# Mandatory: One or more tracking issues related to the change. You can use the PR number here if no issue exists.
+issues: [35175]
+
+# (Optional) One or more lines of additional information to render under the primary note.
+# These lines will be padded with 2 spaces and then inserted directly into the document.
+# Use pipe (|) for multiline entries.
+subtext:
+
+# If your change doesn't affect end users or the exported elements of any package,
+# you should instead start your pull request title with [chore] or use the "Skip Changelog" label.
+# Optional: The change log or logs in which this entry should be included.
+# e.g. '[user]' or '[user, api]'
+# Include 'user' if the change is relevant to end users.
+# Include 'api' if there is a change to a library API.
+# Default: '[user]'
+change_logs: [user]

pkg/stanza/operator/input/windows/input.go

@@ -216,6 +216,16 @@ func (i *Input) read(ctx context.Context) int {
 	events, err := i.subscription.Read(i.maxReads)
 	if err != nil {
 		i.Logger().Error("Failed to read events from subscription", zap.Error(err))
+		if i.isRemote() && (errors.Is(err, windows.ERROR_INVALID_HANDLE) || errors.Is(err, errSubscriptionHandleNotOpen)) {
+			i.Logger().Info("Resubscribing, closing remote subscription")
+			closeErr := i.subscription.Close()
+			if closeErr != nil {
+				i.Logger().Error("Failed to close remote subscription", zap.Error(closeErr))
+				return 0
+			}
+			i.Logger().Info("Resubscribing, creating remote subscription")
+			i.subscription = NewRemoteSubscription(i.remote.Server)
+		}
 		return 0
 	}
 

pkg/stanza/operator/input/windows/subscription.go

@@ -64,10 +64,12 @@ func (s *Subscription) Close() error {
 	return nil
 }
 
+var errSubscriptionHandleNotOpen = errors.New("subscription handle is not open")
+
 // Read will read events from the subscription.
 func (s *Subscription) Read(maxReads int) ([]Event, error) {
 	if s.handle == 0 {
-		return nil, fmt.Errorf("subscription handle is not open")
+		return nil, errSubscriptionHandleNotOpen
 	}
 
 	if maxReads < 1 {