ksfe21
June 21, 2021, 5:25am
1
Доброго времени суток! Подскажите как исправить данную ошибку в Wazuh?
Вы через logstash данные отправляете?
opened 04:16PM - 01 Feb 19 UTC
bug
platform/windows
## Bug report
**OS** Windows/CentOS7
**Wazuh version**: 3.8.2
**Logstash**:… 6.5.2
**Log sample**
This comes from Windows box with `wazuh-agent` installed, connected to a Linux (CentOS7) running `manager`
Problematic characters here is `™` in `Skype\\x99 7.34`
```
[2019-02-01T15:36:02,091][WARN ][logstash.codecs.json ] Received an event that has a different character encoding than you configured. {:text=>"{\\\"timestamp\\\":\\\"2019-02-01T15:36:01.214+0000\\\",\\\"agent\\\":{\\\"id\\\":\\\"002\\\",\\\"name\\\":\\\"win10_laptop\\\"},\\\"manager\\\":{\\\"name\\\":\\\"lognode-01.local\\\"},\\\"id\\\":\\\"1549035361.0\\\",\\\"full_log\\\":\\\"{\\\\\\\"type\\\\\\\":\\\\\\\"program\\\\\\\",\\\\\\\"ID\\\\\\\":78741874,\\\\\\\"timestamp\\\\\\\":\\\\\\\"2019/02/01 15:36:00\\\\\\\",\\\\\\\"program\\\\\\\":{\\\\\\\"format\\\\\\\":\\\\\\\"win\\\\\\\",\\\\\\\"name\\\\\\\":\\\\\\\"Skype\\x99 7.34\\\\\\\",\\\\\\\"architecture\\\\\\\":\\\\\\\"i686\\\\\\\",\\\\\\\"version\\\\\\\":\\\\\\\"7.34.102\\\\\\\",\\\\\\\"vendor\\\\\\\":\\\\\\\"Skype Technologies S.A.\\\\\\\",\\\\\\\"install_time\\\\\\\":\\\\\\\"20180212\\\\\\\",\\\\\\\"location\\\\\\\":\\\\\\\"C:\\\\\\\\\\\\\\\\Program Files (x86)\\\\\\\\\\\\\\\\Skype\\\\\\\\\\\\\\\\\\\\\\\"}}\\\",\\\"decoder\\\":{\\\"name\\\":\\\"syscollector\\\"},\\\"location\\\":\\\"syscollector\\\"}", :expected_charset=>"UTF-8"}
```
I encounter these a lot with in event logs from windows. Quotes for example.
```
...ount by explicitly specifying that account\\x92s credentials. This most com....
```
This happens in various audit events where a users full name is present and has non ascii characters.
system
July 19, 2021, 3:29pm
3
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
