# Getting lots of "failed to load publisher metadata for" into winlogbeat **URL:** \ **Category:** Beats\ **Tags:** winlogbeat\ **Created:** [February 20, 2024, 2:54pm UTC](https://discuss.elastic.co/t/getting-lots-of-failed-to-load-publisher-metadata-for-into-winlogbeat/353709 "2024-02-20T14:54:17Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![yquirion](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yquirion/32/107068_2.png) [@yquirion](https://discuss.elastic.co/u/yquirion)\ **Post date:** [February 20, 2024, 2:54pm UTC](https://discuss.elastic.co/t/getting-lots-of-failed-to-load-publisher-metadata-for-into-winlogbeat/353709/1 "2024-02-20T14:54:17Z")
Dear all, I have configures my Windows servers to send their logs to a Windows Event Collector (WEC). On this server, I created a "subscription" to send `System` and `Security` event logs to that WEC server. On the WEC server, I installed a winlogbeat agent and enabled the "ForwardedEvents" to be sent to my ELK cluster: ```auto winlogbeat.event_logs: - name: ForwardedEvents ignore_older: 96h event_id: -5152,-5156,-5157,-5158 tags: [forwarded] ``` So far so good. But later I modify that subscription to add more logs: I added _Application_, _Windows Powershell_, Microsoft-Windows-PowerShell/Admin\*, _Microsoft-Windows-PowerShell/Operational_. When the WEC started receiving those event, the winlogbeat started to display lots of warning into its log file: ```auto {"log.level":"warn","@timestamp":"2024-02-20T09:11:20.810-0500","log.origin":{"file.name":"eventlog/wineventlog.go","file.line":637},"message":"failed to load publisher metadata for Passwordstate Service (returning an empty metadata store): failed in EvtOpenPublisherMetadata: The system cannot find the file specified.","service.name":"winlogbeat","ecs.version":"1.6.0"} {"log.level":"warn","@timestamp":"2024-02-20T09:11:22.744-0500","log.origin":{"file.name":"eventlog/wineventlog.go","file.line":637},"message":"failed to load publisher metadata for AD FS (returning an empty metadata store): failed in EvtOpenPublisherMetadata: The system cannot find the file specified.","service.name":"winlogbeat","ecs.version":"1.6.0"} {"log.level":"warn","@timestamp":"2024-02-20T09:11:23.214-0500","log.origin":{"file.name":"eventlog/wineventlog.go","file.line":637},"message":"failed to load publisher metadata for COM+ SOAP Services (returning an empty metadata store): failed in EvtOpenPublisherMetadata: The system cannot find the file specified.","service.name":"winlogbeat","ecs.version":"1.6.0"} {"log.level":"warn","@timestamp":"2024-02-20T09:11:25.195-0500","log.origin":{"file.name":"eventlog/wineventlog.go","file.line":637},"message":"failed to load publisher metadata for Directory Synchronization (returning an empty metadata store): failed in EvtOpenPublisherMetadata: The system cannot find the file specified.","service.name":"winlogbeat","ecs.version":"1.6.0"} {"log.level":"warn","@timestamp":"2024-02-20T09:11:25.197-0500","log.origin":{"file.name":"eventlog/wineventlog.go","file.line":637},"message":"failed to load publisher metadata for ADSync (returning an empty metadata store): failed in EvtOpenPublisherMetadata: The system cannot find the file specified.","service.name":"winlogbeat","ecs.version":"1.6.0"} {"log.level":"warn","@timestamp":"2024-02-20T09:11:27.397-0500","log.origin":{"file.name":"eventlog/wineventlog.go","file.line":637},"message":"failed to load publisher metadata for PasswordResetService (returning an empty metadata store): failed in EvtOpenPublisherMetadata: The system cannot find the file specified.","service.name":"winlogbeat","ecs.version":"1.6.0"} {"log.level":"warn","@timestamp":"2024-02-20T09:11:27.538-0500","log.origin":{"file.name":"eventlog/wineventlog.go","file.line":637},"message":"failed to load publisher metadata for nssm (returning an empty metadata store): failed in EvtOpenPublisherMetadata: The system cannot find the file specified.","service.name":"winlogbeat","ecs.version":"1.6.0"} {"log.level":"warn","@timestamp":"2024-02-20T09:11:32.335-0500","log.origin":{"file.name":"eventlog/wineventlog.go","file.line":637},"message":"failed to load publisher metadata for gupdate (returning an empty metadata store): failed in EvtOpenPublisherMetadata: The system cannot find the file specified.","service.name":"winlogbeat","ecs.version":"1.6.0"} {"log.level":"warn","@timestamp":"2024-02-20T09:11:36.417-0500","log.origin":{"file.name":"wineventlog/metadata_store.go","file.line":182},"message":"Failed to read event metadata from publisher. Continuing to next event.","service.name":"winlogbeat","publisher":"Microsoft-Windows-Perflib","error":{"message":"XML syntax error on line 5: unexpected EOF"},"ecs.version":"1.6.0"} {"log.level":"warn","@timestamp":"2024-02-20T09:11:36.417-0500","log.origin":{"file.name":"wineventlog/metadata_store.go","file.line":182},"message":"Failed to read event metadata from publisher. Continuing to next event.","service.name":"winlogbeat","publisher":"Microsoft-Windows-Perflib","error":{"message":"XML syntax error on line 5: unexpected EOF"},"ecs.version":"1.6.0"} {"log.level":"warn","@timestamp":"2024-02-20T09:11:36.417-0500","log.origin":{"file.name":"wineventlog/metadata_store.go","file.line":182},"message":"Failed to read event metadata from publisher. Continuing to next event.","service.name":"winlogbeat","publisher":"Microsoft-Windows-Perflib","error":{"message":"XML syntax error on line 5: unexpected EOF"},"ecs.version":"1.6.0"} {"log.level":"warn","@timestamp":"2024-02-20T09:11:41.512-0500","log.origin":{"file.name":"eventlog/wineventlog.go","file.line":637},"message":"failed to load publisher metadata for MSExchangeIS (returning an empty metadata store): failed in EvtOpenPublisherMetadata: The system cannot find the file specified.","service.name":"winlogbeat","ecs.version":"1.6.0"} {"log.level":"warn","@timestamp":"2024-02-20T09:11:48.791-0500","log.origin":{"file.name":"eventlog/wineventlog.go","file.line":637},"message":"failed to load publisher metadata for MSSQL$MICROSOFT##WID (returning an empty metadata store): failed in EvtOpenPublisherMetadata: The system cannot find the file specified.","service.name":"winlogbeat","ecs.version":"1.6.0"} {"log.level":"warn","@timestamp":"2024-02-20T09:11:50.744-0500","log.origin":{"file.name":"eventlog/wineventlog.go","file.line":637},"message":"failed to load publisher metadata for ASP.NET 4.0.30319.0 (returning an empty metadata store): failed in EvtOpenPublisherMetadata: The system cannot find the file specified.","service.name":"winlogbeat","ecs.version":"1.6.0"} {"log.level":"warn","@timestamp":"2024-02-20T09:11:51.181-0500","log.origin":{"file.name":"eventlog/wineventlog.go","file.line":517},"message":"WinEventLog[WEC-STI/ADFS] EventHandles returned error The query result is stale or invalid and must be recreated. This may be due to the log being cleared or rolling over after the query result was created.","service.name":"winlogbeat","ecs.version":"1.6.0"} {"log.level":"warn","@timestamp":"2024-02-20T09:11:51.181-0500","log.logger":"winlogbeat","log.origin":{"file.name":"beater/eventlogger.go","file.line":179},"message":"Read() encountered recoverable error. Reopening handle...","service.name":"winlogbeat","id":"WEC-STI/ADFS","error":{"message":"The query result is stale or invalid and must be recreated. This may be due to the log being cleared or rolling over after the query result was created."},"channel":"WEC-STI/ADFS","ecs.version":"1.6.0"} {"log.level":"warn","@timestamp":"2024-02-20T09:12:22.608-0500","log.origin":{"file.name":"eventlog/wineventlog.go","file.line":637},"message":"failed to load publisher metadata for sshd (returning an empty metadata store): failed in EvtOpenPublisherMetadata: The system cannot find the file specified.","service.name":"winlogbeat","ecs.version":"1.6.0"} {"log.level":"warn","@timestamp":"2024-02-20T09:12:30.453-0500","log.origin":{"file.name":"eventlog/wineventlog.go","file.line":637},"message":"failed to load publisher metadata for Xerox CentreWare Web (returning an empty metadata store): failed in EvtOpenPublisherMetadata: The system cannot find the file specified.","service.name":"winlogbeat","ecs.version":"1.6.0"} {"log.level":"warn","@timestamp":"2024-02-20T09:12:46.668-0500","log.origin":{"file.name":"eventlog/wineventlog.go","file.line":637},"message":"failed to load publisher metadata for MSExchangeTransport (returning an empty metadata store): failed in EvtOpenPublisherMetadata: The system cannot find the file specified.","service.name":"winlogbeat","ecs.version":"1.6.0"} {"log.level":"warn","@timestamp":"2024-02-20T09:12:51.536-0500","log.origin":{"file.name":"eventlog/wineventlog.go","file.line":637},"message":"failed to load publisher metadata for MSExchangeFrontEndTransport (returning an empty metadata store): failed in EvtOpenPublisherMetadata: The system cannot find the file specified.","service.name":"winlogbeat","ecs.version":"1.6.0"} {"log.level":"warn","@timestamp":"2024-02-20T09:12:51.727-0500","log.origin":{"file.name":"eventlog/wineventlog.go","file.line":637},"message":"failed to load publisher metadata for Microsoft-Filtering-FIPFS (returning an empty metadata store): failed in EvtOpenPublisherMetadata: The system cannot find the file specified.","service.name":"winlogbeat","ecs.version":"1.6.0"} {"log.level":"warn","@timestamp":"2024-02-20T09:12:51.738-0500","log.origin":{"file.name":"eventlog/wineventlog.go","file.line":637},"message":"failed to load publisher metadata for MSExchangeTransportDelivery (returning an empty metadata store): failed in EvtOpenPublisherMetadata: The system cannot find the file specified.","service.name":"winlogbeat","ecs.version":"1.6.0"} {"log.level":"warn","@timestamp":"2024-02-20T09:12:51.755-0500","log.origin":{"file.name":"eventlog/wineventlog.go","file.line":637},"message":"failed to load publisher metadata for MSExchangeTransportSubmission (returning an empty metadata store): failed in EvtOpenPublisherMetadata: The system cannot find the file specified.","service.name":"winlogbeat","ecs.version":"1.6.0"} {"log.level":"warn","@timestamp":"2024-02-20T09:12:54.208-0500","log.origin":{"file.name":"eventlog/wineventlog.go","file.line":637},"message":"failed to load publisher metadata for MSExchange Mid-Tier Storage (returning an empty metadata store): failed in EvtOpenPublisherMetadata: The system cannot find the file specified.","service.name":"winlogbeat","ecs.version":"1.6.0"} {"log.level":"warn","@timestamp":"2024-02-20T09:13:10.945-0500","log.origin":{"file.name":"eventlog/wineventlog.go","file.line":637},"message":"failed to load publisher metadata for Fusion Audit (returning an empty metadata store): failed in EvtOpenPublisherMetadata: The system cannot find the file specified.","service.name":"winlogbeat","ecs.version":"1.6.0"} {"log.level":"warn","@timestamp":"2024-02-20T09:13:17.648-0500","log.origin":{"file.name":"eventlog/wineventlog.go","file.line":637},"message":"failed to load publisher metadata for MSExchange RBAC (returning an empty metadata store): failed in EvtOpenPublisherMetadata: The system cannot find the file specified.","service.name":"winlogbeat","ecs.version":"1.6.0"} ``` Searching the web I found this, but there are no really conclusion: [https://github.com/elastic/beats/issues/36111](https://github.com/elastic/beats/issues/36111) and its related to version 7.x of the beat. I'm running version 8.11.1 I'm wondering why the winlogbeat log file is complaining about thise things: `Service`, `AD FS`, `COM+ SOAP Services`, `Directory Synchronization`, `PasswordResetService`, `nssm`, `gupdate`, and so on... Since I was getting too many of those warnings, I just updated the WEC Subscription to only sends `System` and `Secutity` like I did at the beginning. Those errors slow down a lot to almost nothing. Just get 3 of those warning in the past 15 minutes. If you need more information, please feel free to ask me! Thank you and best regards, Yanick ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [February 20, 2024, 3:41pm UTC](https://discuss.elastic.co/t/getting-lots-of-failed-to-load-publisher-metadata-for-into-winlogbeat/353709/2 "2024-02-20T15:41:07Z")
Are your WEC subscriptions configured to send `RenderedText`? Add `forwarded: true` ([docs](https://www.elastic.co/guide/en/beats/winlogbeat/current/configuration-winlogbeat-options.html#_event_logs_forwarded)) to all of the readers that are consuming forwarded logs. This should stop Winlogbeat from trying to source the message contents from the collector host. ```auto winlogbeat.event_logs: - name: MyForwardedChannel forwarded: true ... ``` ---
**Author:** ![yquirion](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yquirion/32/107068_2.png) [@yquirion](https://discuss.elastic.co/u/yquirion)\ **Post date:** [February 20, 2024, 4:34pm UTC](https://discuss.elastic.co/t/getting-lots-of-failed-to-load-publisher-metadata-for-into-winlogbeat/353709/3 "2024-02-20T16:34:06Z")
Hi @andrewkroh, Thank you very much for your reply. The documentation says: > The value defaults to true for the ForwardedEvents log and false for any other log So I tought I didn't need to specify that parameter, but to make sure, I added it. Unfortunately, after restarting the winlogbeat, I got some of those warnings again: ```auto {"log.level":"warn","@timestamp":"2024-02-20T11:22:41.833-0500","log.origin":{"file.name":"eventlog/wineventlog.go","file.line":637},"message":"failed to load publisher metadata for AD FS Auditing (returning an empty metadata store): failed in EvtOpenPublisherMetadata: The system cannot find the file specified.","service.name":"winlogbeat","ecs.version":"1.6.0"} {"log.level":"warn","@timestamp":"2024-02-20T11:22:41.833-0500","log.origin":{"file.name":"eventlog/wineventlog.go","file.line":637},"message":"failed to load publisher metadata for Microsoft-Windows-IIS-Logging (returning an empty metadata store): failed in EvtOpenPublisherMetadata: The system cannot find the file specified.","service.name":"winlogbeat","ecs.version":"1.6.0"} {"log.level":"warn","@timestamp":"2024-02-20T11:22:41.862-0500","log.origin":{"file.name":"eventlog/wineventlog.go","file.line":637},"message":"failed to load publisher metadata for AD FS (returning an empty metadata store): failed in EvtOpenPublisherMetadata: The system cannot find the file specified.","service.name":"winlogbeat","ecs.version":"1.6.0"} ``` Here is how is configured my WEC subscription: ```auto C:\>wecutil gs "Logon" Subscription Id: Logon SubscriptionType: SourceInitiated Description: Inventorier l'ouverture de session sur les serveurs windows Enabled: true Uri: http://schemas.microsoft.com/wbem/wsman/1/windows/EventLog ConfigurationMode: Normal DeliveryMode: Push DeliveryMaxLatencyTime: 900000 HeartbeatInterval: 900000 Query: *[System[(EventID=5152 or EventID=5157)]]*[System[(EventID=5152 or EventID=5157)]] ReadExistingEvents: false TransportName: HTTPS ContentFormat: RenderedText Locale: en-CA LogFile: ForwardedEvents PublisherName: Microsoft-Windows-EventCollector ``` As we can see, they are configured in `RenderedText`. Is this may be a bug in my version of winlogbeat? The event who is generating lots those warning is the `Application` one. The WEC server doesn't have all the different `Event Sources` that are available on other servers: ![image](https://us1.discourse-cdn.com/elastic/original/3X/c/c/cc84a165cb0710242f913567adc1b366f3465e29.png) Thanks again for your time, I appreciate it! Regards, Yanick ---
**Author:** ![yquirion](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yquirion/32/107068_2.png) [@yquirion](https://discuss.elastic.co/u/yquirion)\ **Post date:** [February 20, 2024, 4:59pm UTC](https://discuss.elastic.co/t/getting-lots-of-failed-to-load-publisher-metadata-for-into-winlogbeat/353709/4 "2024-02-20T16:59:02Z")
Hi again! I just created another subsciption only for `Application` and selected some of my computers to use that new subscription. ```auto Application Logs SourceInitiated true http://schemas.microsoft.com/wbem/wsman/1/windows/EventLog MinLatency 30000 ]]> false HTTPS RenderedText WEC-FMSS ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ ZZZZZZZZZZZZZZZZZZZZZZ: ``` I configure it to send the logs into a custom destination for those events. Then I enable this new source into winlogbeat: ```auto name: WEC-FMSS ignore_older: 96h forwarded: true tags: [wec-fmss] ``` Looking at the winlogbeat log file while looking at this destination log folder, I saw: ![image](https://us1.discourse-cdn.com/elastic/original/3X/9/6/961dc86452197653dc4cd6223946a7471190d896.png) But when looking at Kibana, all data seems to be there: ![image](https://us1.discourse-cdn.com/elastic/original/3X/3/0/30b2c103a5b315aea02676a50232b07e42d35f62.png) Thanks! Yanick ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 19, 2024, 6:59pm UTC](https://discuss.elastic.co/t/getting-lots-of-failed-to-load-publisher-metadata-for-into-winlogbeat/353709/5 "2024-03-19T18:59:40Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.