Win32_Service queries hanging

Elastic Stack Beats
,
1

Environment:

  • Windows version: Windows 10 21H2, fully patched
  • Beats versions: 8.9.0, 8.9.1 (winlogbeat and filebeat)

Steps to Reproduce:

  • Install beats versions 8.9.0 or 8.9.1 as a windows service.
  • Attempt to make a WMI query to Win32_Service.

Expected Results:

  • The query should be handled smoothly without any lag or hang.

Actual Results:

  • The query hangs and does not complete in a timely manner.
  • Force killing the beats process immediately allows the queries to complete.

Notes:

  • I am not experiencing this issue with older versions (like 8.8.2 and previous).

Question:

  • Is anyone else experiencing this? Are there any known workarounds or solutions?

Here is the WMI query in question:
Get-CimInstance Win32_Service

2

Only the Metricbeat windows.service module uses WMI. Are you running that?

I've never done any WMI debugging, but after a few searches it seems that enabling WMI trace logging might help give you some indication of what WMI is doing. Tracing WMI Activity - Win32 apps | Microsoft Learn

3

The issue isn't with WMI inside of beats application, but rather when a beats application is installed as a Windows Service.

After that happends simple queries like Get-CimInstance Win32_Service hang

4

Seems like there has been at least one workaround for Win32_Service issues in the beats repo

5

Additionally, service control thing seems to be generally broken in these later versions.

Simply trying to stop the Winlogbeat service hangs.
Get-Service Winlogbeat | Stop-Service

Is anyone else running into similar issues?

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.