# EvtSeek used by winlogbeats go wrong when arch is 386

**URL:** <https://discuss.elastic.co/t/evtseek-used-by-winlogbeats-go-wrong-when-arch-is-386/195825>\
**Category:** Beats\
**Created:** [August 20, 2019, 12:50am UTC](https://discuss.elastic.co/t/evtseek-used-by-winlogbeats-go-wrong-when-arch-is-386/195825 "2019-08-20T00:50:44Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![tianlin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tianlin/32/25540_2.png) [@tianlin](https://discuss.elastic.co/u/tianlin)\
**Post date:** [August 20, 2019, 12:50am UTC](https://discuss.elastic.co/t/evtseek-used-by-winlogbeats-go-wrong-when-arch-is-386/195825/1 "2019-08-20T00:50:44Z")

</div>

Hi, I found there is a bug in \_EvtSeek. position is int64, but in 386, it must call  
syscall.Syscall6(procEvtSeek.Addr(), 6, uintptr(resultSet), uintptr(position), uintptr(position\>\>32), uintptr(bookmark), uintptr(timeout), uintptr(flags)) to work right.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 17, 2019, 2:50am UTC](https://discuss.elastic.co/t/evtseek-used-by-winlogbeats-go-wrong-when-arch-is-386/195825/2 "2019-09-17T02:50:45Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.