trying to update our beats v.7.6.2 to 7.7.0, but for some reasons it seems that ~25-30% of them fails to launch the service after installing. v.7.6.2 was running just fine.
Debug log from an launch attempt of AuditBeat 7.7.0:
2020-05-26T13:22:02.227+0200 INFO instance/beat.go:621 Home path: [C:\Program Files\AuditBeat] Config path: [C:\Program Files\AuditBeat] Data path: [C:\Program Files\AuditBeat\data] Logs path: [C:\Program Files\AuditBeat\logs]
2020-05-26T13:22:02.227+0200 DEBUG [beat] instance/beat.go:673 Beat metadata path: C:\Program Files\AuditBeat\data\meta.json
2020-05-26T13:22:02.228+0200 INFO instance/beat.go:629 Beat ID: d4284548-792e-4eb0-84df-ce7fc1d9e409
2020-05-26T13:22:02.253+0200 DEBUG [conditions] conditions/conditions.go:98 New condition regexp: map[]
2020-05-26T13:22:02.254+0200 DEBUG [conditions] conditions/conditions.go:98 New condition regexp: map[]
2020-05-26T13:22:02.254+0200 DEBUG [conditions] conditions/conditions.go:98 New condition regexp: map[] or regexp: map[]
2020-05-26T13:22:02.254+0200 DEBUG [processors] processors/processor.go:101 Generated new processors: add_host_metadata=[netinfo.enabled=[true], cache.ttl=[5m0s]], add_fields={"host":{"<redacted>":{"assetid":<redacted>,"customerid":<redacted>}}}, drop_event, condition=regexp: map[] or regexp: map[]
2020-05-26T13:22:02.254+0200 DEBUG [seccomp] seccomp/seccomp.go:96 Syscall filtering is only supported on Linux
2020-05-26T13:22:02.254+0200 INFO [beat] instance/beat.go:957 Beat info {"system_info": {"beat": {"path": {"config": "C:\\Program Files\\AuditBeat", "data": "C:\\Program Files\\AuditBeat\\data", "home": "C:\\Program Files\\AuditBeat", "logs": "C:\\Program Files\\AuditBeat\\logs"}, "type": "auditbeat", "uuid": "d4284548-792e-4eb0-84df-ce7fc1d9e409"}}}
2020-05-26T13:22:02.254+0200 INFO [beat] instance/beat.go:966 Build info {"system_info": {"build": {"commit": "5e69e25b920e3d93bec76a09a31da3ab35a55607", "libbeat": "7.7.0", "time": "2020-05-12T00:48:56.000Z", "version": "7.7.0"}}}
2020-05-26T13:22:02.254+0200 INFO [beat] instance/beat.go:969 Go runtime info {"system_info": {"go": {"os":"windows","arch":"amd64","max_procs":4,"version":"go1.13.9"}}}
2020-05-26T13:22:02.265+0200 INFO [beat] instance/beat.go:973 Host info {"system_info": {"host": {"architecture":"x86_64","boot_time":"2020-05-18T04:54:26.39+02:00","name":"<redacted>","ip":["<redacted>","<redacted>","<redacted>","10.0.2.30/22","::1/128","127.0.0.1/8","<redacted>","<redacted>","<redacted>"],"kernel_version":"6.3.9600.19697 (winblue_ltsb.200411-0600)","mac":["00:50:56:07:14:c0","00:50:56:07:14:bf","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0","00:00:00:00:00:00:00:e0"],"os":{"family":"windows","platform":"windows","name":"Windows Server 2012 R2 Standard","version":"6.3","major":3,"minor":0,"patch":0,"build":"9600.19701"},"timezone":"CEST","timezone_offset_sec":7200,"id":"460c64b3-811b-42da-990f-3ebd45af8a69"}}}
2020-05-26T13:22:02.278+0200 INFO [beat] instance/beat.go:1002 Process info {"system_info": {"process": {"cwd": "C:\\windows\\system32", "exe": "C:\\Program Files\\AuditBeat\\AuditBeat.exe", "name": "AuditBeat.exe", "pid": 7404, "ppid": 540, "start_time": "2020-05-26T13:22:01.314+0200"}}}
2020-05-26T13:22:02.278+0200 INFO instance/beat.go:297 Setup Beat: auditbeat; Version: 7.7.0
2020-05-26T13:22:02.278+0200 DEBUG [beat] instance/beat.go:323 Initializing output plugins
2020-05-26T13:22:02.279+0200 INFO eslegclient/connection.go:84 elasticsearch url: https://<redacted>:443
2020-05-26T13:22:02.279+0200 DEBUG [publisher] pipeline/consumer.go:137 start pipeline event consumer
2020-05-26T13:22:02.279+0200 INFO [publisher] pipeline/module.go:110 Beat name: <redacted>
2020-05-26T13:22:02.279+0200 DEBUG [modules] beater/metricbeat.go:148 Available modules and metricsets: Register [ModuleFactory:[system], MetricSetFactory:[auditd/auditd, file_integrity/file, system/host, system/login, system/package, system/process, system/socket, system/user]]
2020-05-26T13:22:02.280+0200 DEBUG [file_integrity] file_integrity/metricset.go:99 Initialized the file event reader. Running as euid=-1
2020-05-26T13:22:02.292+0200 WARN [cfgwarn] host/host.go:167 BETA: The system/host dataset is beta
2020-05-26T13:22:02.297+0200 DEBUG [system] host/host.go:448 Restored last host information from disk.
2020-05-26T13:22:02.308+0200 WARN [cfgwarn] process/process.go:131 BETA: The system/process dataset is beta
2020-05-26T13:22:02.311+0200 DEBUG [process] process/process.go:168 Last state was sent at 2020-05-25 07:59:05.2643965 +0200 CEST. Next state update by 2020-05-25 19:59:05.2643965 +0200 CEST.
2020-05-26T13:22:02.311+0200 INFO instance/beat.go:438 auditbeat start running.
2020-05-26T13:22:02.312+0200 DEBUG [module] module/wrapper.go:127 Starting Wrapper[name=file_integrity, len(metricSetWrappers)=1]
2020-05-26T13:22:02.312+0200 DEBUG [module] module/wrapper.go:127 Starting Wrapper[name=system, len(metricSetWrappers)=1]
2020-05-26T13:22:02.312+0200 DEBUG [service] service/service_windows.go:72 Windows is interactive: false
2020-05-26T13:22:02.312+0200 DEBUG [module] module/wrapper.go:181 file_integrity/file will start after 2.64675034s
2020-05-26T13:22:02.312+0200 DEBUG [module] module/wrapper.go:181 system/host will start after 7.662300006s
2020-05-26T13:22:02.312+0200 DEBUG [module] module/wrapper.go:127 Starting Wrapper[name=system, len(metricSetWrappers)=1]
2020-05-26T13:22:02.312+0200 DEBUG [module] module/wrapper.go:181 system/process will start after 1.550783582s
No explanation as to why the process stops it seems, this is all I see from the Service Launch event:
Any hint appreciated!
TIA
