SecureAuth/Elastic FileBeat service will not start

SecureAuth IdP Version Affected: 9.2 and up

Description: The SecureAuth/Elastic FileBeat service will not start, and will throw 'Error 1067: The process terminated unexpectedly' when trying to start it manually via the Services console.

Cause: The FileBeat service was not properly shut down, and cannot read the the registry file. 

The following log entry will appear in the latest FileBeat log file, located at 'C:\ProgramData\SecureAuth Corporation\filebeat\logs':

2019-03-28T10:38:32-04:00 CRIT Exiting: Could not start registrar: Error loading state: Error decoding states: invalid character '\x00' looking for beginning of value

Resolution: 

1. Delete the following two files (registry and registry.old) from the 'C:\ProgramData\SecureAuth Corporation\filebeat\data' directory:

2. Finally, start the SecureAuth/ElasticFileBeat service from the Services console.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.
Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.