Server 2008 R2 Access Denied for PIDs

Elastic Stack Beats
1

Hi,

I've recently deployed topbeat to a single Windows 2008 R2 server and when running it starts without issue, however, I don't get any process information and no matter what admin logon as account I use, local or domain, the log file fills up with -

Skip process pid=4: error getting process state for pid=4: OpenProcess fails with Access is denied.

Any suggestions as to what may cause this?

Many Thanks

Jez

2

Got the same issue here:
https://discuss.elastic.co/t/server-2012-r2-some-metrics-not-send/?source_topic_id=53232

By any chance, is topbeat installed on a VMware machine?

3

This one is running on a Hyper-V 2012 R2 host, I've not compared to physical machine but I can do that and test on VMWare as well and report the results.

4

Works fine on a physical server with the same OS.

5

I'm guessing this issue exists because the OS is hosted on a virtual platform.
You have the issue on an Hyper-V host. I have the issue on a VMware host.
When topBeat runs from a physical server, it runs fine.

In the case of a virtual host; TopBeat can't access several parts of the OS.
Either because it has no rights (even tho it is executed as admin with the highest privileges)
Or because topbeat is trying to access parts which are 'locked' in the OS, therefor cannot be accessed.
Or because it is trying to capture the wrong resources.

I'm still just guessing. Perhaps a dev from Elastic can respond.

6

Interesting, it should be transparent to the beat though. I'll do some more testing at this end. Curious if anyone else has it running in a VM already as well...we can't be the first.....and as you say maybe some feedback from a dev.

I'll feedback any findings I come up with, I've done the usual compatibility mode settings etc. and even run it from a PowerShell command line and all give the same results.

With Metric Beats on the horizon maybe its fixed in there, I can test that as well.

7

It looks like an access problem (as also discussed in the other thread). As topbeat and metricbeat use the same code in the background, I would be surprised if the problem is solved with Metricbeat.

It would be nice if you could post more details about your tests and log outputs (but please not as screenshot).

8

This topic was automatically closed after 21 days. New replies are no longer allowed.