{"record":{"id":"474e77dbec8cabae","repo":"cloudflare/cloudflared","slug":"error-retrieving-output-from-command-s-w-474e77","errorCode":null,"errorMessage":"error retrieving output from command '%s': %w","messagePattern":"error retrieving output from command '(.+?)': %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"diagnostic/system_collector_windows.go","lineNumber":107,"sourceCode":"\treturn info, err\n}\n\nfunc collectMemoryInformation(ctx context.Context) (*MemoryInformation, string, error) {\n\tconst (\n\t\tmemoryTotalPrefix     = \"TotalVirtualMemorySize\"\n\t\tmemoryAvailablePrefix = \"FreeVirtualMemory\"\n\t)\n\n\tcommand := exec.CommandContext(\n\t\tctx,\n\t\t\"powershell\",\n\t\t\"-Command\",\n\t\t\"Get-CimInstance -Class Win32_OperatingSystem | Select-Object FreeVirtualMemory, TotalVirtualMemorySize | Format-List\",\n\t)\n\n\tstdout, err := command.Output()\n\tif err != nil {\n\t\treturn nil, \"\", fmt.Errorf(\"error retrieving output from command '%s': %w\", command.String(), err)\n\t}\n\n\toutput := string(stdout)\n\n\t// the result of the command above will return values in bytes hence\n\t// they need to be converted to kilobytes\n\tmapper := func(field string) (uint64, error) {\n\t\tvalue, err := strconv.ParseUint(field, 10, 64)\n\t\treturn uint64(float64(value) * kiloBytesScale), err\n\t}\n\n\tmemoryInfo, err := ParseMemoryInformationFromKV(output, memoryTotalPrefix, memoryAvailablePrefix, mapper)\n\tif err != nil {\n\t\treturn nil, output, err\n\t}\n\n\t// returning raw output in case other collected information\n\t// resulted in errors","sourceCodeStart":89,"sourceCodeEnd":125,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/diagnostic/system_collector_windows.go#L89-L125","documentation":"collectMemoryInformation on Windows runs a PowerShell command (Get-CimInstance Win32_OperatingSystem | Select FreeVirtualMemory, TotalVirtualMemorySize | Format-List) and this error wraps any command.Output() failure. It means PowerShell could not be launched, the command was cancelled, or it exited non-zero — no memory stdout was produced for parsing. The wrapped command string and error reveal the exact launch/exit cause.","triggerScenarios":"Collect() calls collectMemoryInformation on Windows; 'powershell' is not on PATH (PowerShell removed or only pwsh installed), the Win32_OperatingSystem CIM query fails (WMI/CIM service stopped), the context deadline expires, or a security policy blocks powershell.exe.","commonSituations":"Systems where Windows PowerShell was uninstalled and only PowerShell 7 (pwsh.exe) exists, the WMI (Winmgmt) service disabled or broken in stripped-down Windows images, endpoint security (AppLocker/WDAC) blocking powershell.exe, or slow CIM queries exceeding the diagnostic timeout.","solutions":["Check the wrapped error: 'executable file not found' means restore Windows PowerShell (optional features) or patch the environment so powershell.exe is on PATH.","Ensure the WMI/Winmgmt service is running: 'Get-Service winmgmt' and 'winmgmt /verifyrepository' — restart or repair the repository if broken.","Run the exact Get-CimInstance command manually in PowerShell to see any non-zero exit cause (CIM errors surface there).","If AppLocker/WDAC blocks powershell.exe, add an allow rule for the cloudflared process or script path.","If the error is context deadline exceeded, investigate slow CIM/WMI startup and increase the diagnostic timeout."],"exampleFix":"// before: only PowerShell 7 present\nC:\\> where powershell  →  not found\n\n// after: restore Windows PowerShell optional feature\nAdd-WindowsCapability -Online -Name Microsoft.Windows.PowerShell.ISE~~~~0.0.1.0\n# or ensure C:\\Windows\\System32\\WindowsPowerShell\\v1.0 is on PATH","handlingStrategy":"try-catch","validationCode":"if _, err := exec.LookPath(\"powershell\"); err != nil {\n    return fmt.Errorf(\"Windows PowerShell not on PATH: %w\", err)\n}\nif svc, err := exec.Command(\"sc\", \"query\", \"winmgmt\").Output(); err != nil || !strings.Contains(string(svc), \"RUNNING\") {\n    return fmt.Errorf(\"WMI service (winmgmt) not running\")\n}","typeGuard":"func powershellReady() bool {\n    if _, err := exec.LookPath(\"powershell\"); err != nil {\n        return false\n    }\n    out, err := exec.Command(\"powershell\", \"-NoProfile\", \"-Command\", \"Get-Service winmgmt\").Output()\n    return err == nil && strings.Contains(string(out), \"Running\")\n}","tryCatchPattern":"info, raw, err := collector.Collect(ctx)\nif err != nil && strings.Contains(err.Error(), \"error retrieving output from command 'powershell\") {\n    log.Warn().Err(err).Msg(\"Windows memory collection failed; check PowerShell and WMI health\")\n    // retry once after restarting winmgmt, or skip the memory section\n}","preventionTips":["Keep Windows PowerShell (powershell.exe) installed; don't remove it when adding PowerShell 7.","Monitor the Winmgmt service health and verify the WMI repository periodically (winmgmt /verifyrepository).","Ensure AppLocker/WDAC rules permit powershell.exe for the account running cloudflared.","Run the Get-CimInstance query in a scheduled health check so regressions surface before diagnostics fail.","Use bounded timeouts so slow CIM responses appear as timeouts you can act on."],"tags":["go","diagnostics","memory","powershell","windows"],"backgroundTag":"command-execution-failed","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}