# Packetbeat: Packetbeat on Windows Server 2008, running but not logging

**URL:** <https://discuss.elastic.co/t/packetbeat-packetbeat-on-windows-server-2008-running-but-not-logging/44970>\
**Category:** Beats\
**Tags:** packetbeat\
**Created:** [March 21, 2016, 9:59am UTC](https://discuss.elastic.co/t/packetbeat-packetbeat-on-windows-server-2008-running-but-not-logging/44970 "2016-03-21T09:59:50Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![krushnat\_khawale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/krushnat_khawale/32/6652_2.png) [@krushnat\_khawale](https://discuss.elastic.co/u/krushnat_khawale)\
**Post date:** [March 21, 2016, 9:59am UTC](https://discuss.elastic.co/t/packetbeat-packetbeat-on-windows-server-2008-running-but-not-logging/44970/1 "2016-03-21T09:59:50Z")

</div>

Hello {Elastic} World,  
I am able to run Packetbeat successfully on one of staging server(windows server 2008),  
but it is not sending data to ES of remote computers.

I've packetbeat logs for 3 days, and I am only seeing following three lines repeatatively,

```
2016-03-18T13:14:15+05:30 INFO GeoIP disabled: No paths were set under output.geoip.paths
2016-03-18T13:14:15+05:30 INFO Activated elasticsearch as output plugin.
2016-03-18T13:14:15+05:30 INFO Publisher name: WINBOM-DCSTART
2016-03-18T13:14:15+05:30 INFO Flush Interval set to: 1s
2016-03-18T13:14:15+05:30 INFO Max Bulk Size set to: 50
2016-03-18T13:14:15+05:30 INFO Init Beat: packetbeat; Version: 1.1.1
2016-03-18T13:14:15+05:30 INFO Resolved device index 0 to device: \Device\NPF_{6B62E55C-11F2-41F8-860C-BF7469444730}
2016-03-18T13:14:15+05:30 INFO packetbeat sucessfully setup. Start running.
2016-03-18T13:14:18+05:30 INFO packet decode failed with: Invalid (too small) IP length (0 < 20)
2016-03-18T13:14:18+05:30 INFO packet decode failed with: Invalid (too small) IP length (0 < 20)
2016-03-18T13:14:22+05:30 WARN Gap in tcp stream. last_seq: 3268359307, seq: 3268424215, gap: 64908
2016-03-18T20:48:56+05:30 INFO Connecting error publishing events (retrying): Head http://10.76.133.15:9200: dial tcp 10.76.133.15:9200: connectex: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond.
2016-03-18T20:48:56+05:30 INFO send fail
2016-03-18T20:48:56+05:30 INFO backoff retry: 1s
2016-03-18T20:49:15+05:30 INFO packet decode failed with: Invalid (too small) IP length (0 < 20)
2016-03-18T20:49:15+05:30 INFO packet decode failed with: Invalid (too small) IP length (0 < 20)
2016-03-21T13:07:24+05:30 WARN Response from unknown transaction. Ingoring.
2016-03-21T13:07:40+05:30 WARN Response from unknown transaction. Ingoring.
```

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [March 21, 2016, 11:46am UTC](https://discuss.elastic.co/t/packetbeat-packetbeat-on-windows-server-2008-running-but-not-logging/44970/2 "2016-03-21T11:46:02Z")

</div>

> [@krushnat\_khawale](#):
>
> ```auto
> 2016-03-18T20:48:56+05:30 INFO Connecting error publishing events (retrying): Head http://10.76.133.15:9200: dial tcp 10.76.133.15:9200: connectex: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond.
> 
> ```

See log message. is ES running and reachable?

---

<div class="post-metadata">

**Author:** ![krushnat\_khawale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/krushnat_khawale/32/6652_2.png) [@krushnat\_khawale](https://discuss.elastic.co/u/krushnat_khawale)\
**Post date:** [March 22, 2016, 12:19pm UTC](https://discuss.elastic.co/t/packetbeat-packetbeat-on-windows-server-2008-running-but-not-logging/44970/3 "2016-03-22T12:19:58Z")

</div>

Yes @steffens and @andrewkroh

I tried to **access ES from the required Windows server 2008, and it is running and reachable**.

Any guess, what might be wrong?

---

<div class="post-metadata">

**Author:** ![krushnat\_khawale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/krushnat_khawale/32/6652_2.png) [@krushnat\_khawale](https://discuss.elastic.co/u/krushnat_khawale)\
**Post date:** [March 22, 2016, 1:32pm UTC](https://discuss.elastic.co/t/packetbeat-packetbeat-on-windows-server-2008-running-but-not-logging/44970/4 "2016-03-22T13:32:12Z")

</div>

Hi @andrewkroh , According to your [suggestion](https://github.com/elastic/beats/issues/104#issuecomment-199525840) we tried npcap on windows7 and our firewall is blocking the program and deleting the starting .exe files as well.

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [March 22, 2016, 1:47pm UTC](https://discuss.elastic.co/t/packetbeat-packetbeat-on-windows-server-2008-running-but-not-logging/44970/5 "2016-03-22T13:47:42Z")

</div>

Maybe you can whitelist npcap with your AV program.

---

<div class="post-metadata">

**Author:** ![krushnat\_khawale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/krushnat_khawale/32/6652_2.png) [@krushnat\_khawale](https://discuss.elastic.co/u/krushnat_khawale)\
**Post date:** [March 23, 2016, 5:02am UTC](https://discuss.elastic.co/t/packetbeat-packetbeat-on-windows-server-2008-running-but-not-logging/44970/6 "2016-03-23T05:02:57Z")

</div>

Yes @steffens and @andrewkroh

I tried to **access ES from the required Windows server 2008, and it is running and reachable**.

Any guess, what might be wrong?

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [March 23, 2016, 1:03pm UTC](https://discuss.elastic.co/t/packetbeat-packetbeat-on-windows-server-2008-running-but-not-logging/44970/7 "2016-03-23T13:03:23Z")

</div>

have you got a firewall or http proxy in between? beats use 'HEAD' request to check if ES is available (kinda of a ping).

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [March 23, 2016, 1:19pm UTC](https://discuss.elastic.co/t/packetbeat-packetbeat-on-windows-server-2008-running-but-not-logging/44970/8 "2016-03-23T13:19:12Z")

</div>

Try running the PowerShell command here to test the HEAD request: [Winlogbeat transport problem on port 80 through reverse proxy to Elasticsearch](https://discuss.elastic.co/t/winlogbeat-transport-problem-on-port-80-through-reverse-proxy-to-elasticsearch/40965/6)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 9:54pm UTC](https://discuss.elastic.co/t/packetbeat-packetbeat-on-windows-server-2008-running-but-not-logging/44970/9 "2017-07-05T21:54:15Z")

</div>