- Windows version: Windows 10 21H2, fully patched
- Beats versions: 8.9.0, 8.9.1 (winlogbeat and filebeat)
Steps to Reproduce:
- Install beats versions 8.9.0 or 8.9.1 as a windows service.
- Attempt to make a WMI query to Win32_Service.
- The query should be handled smoothly without any lag or hang.
- The query hangs and does not complete in a timely manner.
- Force killing the beats process immediately allows the queries to complete.
- I am not experiencing this issue with older versions (like 8.8.2 and previous).
- Is anyone else experiencing this? Are there any known workarounds or solutions?
Here is the WMI query in question:
Only the Metricbeat windows.service module uses WMI. Are you running that?
I've never done any WMI debugging, but after a few searches it seems that enabling WMI trace logging might help give you some indication of what WMI is doing. Tracing WMI Activity - Win32 apps | Microsoft Learn
The issue isn't with WMI inside of beats application, but rather when a beats application is installed as a Windows Service.
After that happends simple queries like
Get-CimInstance Win32_Service hang
Seems like there has been at least one workaround for Win32_Service issues in the beats repo
Additionally, service control thing seems to be generally broken in these later versions.
Simply trying to stop the Winlogbeat service hangs.
Get-Service Winlogbeat | Stop-Service
Is anyone else running into similar issues?
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.