# Winlogbeat collect Active Directory Security event log slowly

**URL:** <https://discuss.elastic.co/t/winlogbeat-collect-active-directory-security-event-log-slowly/154380>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [October 29, 2018, 6:11am UTC](https://discuss.elastic.co/t/winlogbeat-collect-active-directory-security-event-log-slowly/154380 "2018-10-29T06:11:34Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![peterch](https://avatars.discourse-cdn.com/v4/letter/p/e5b9ba/32.png) [@peterch](https://discuss.elastic.co/u/peterch)\
**Post date:** [October 29, 2018, 6:11am UTC](https://discuss.elastic.co/t/winlogbeat-collect-active-directory-security-event-log-slowly/154380/1 "2018-10-29T06:11:34Z")

</div>

Dear All,

I have 3 Active Directory machines which installed winlogbeat. I find there are some issues on collecting security event log.

According to the below chart, it show the received security event from 3 machine

- In the chart, we can see two of the machine's security event log can be received but cannot receive suddenly but application and system event still can be received.

- The other machine security event log can be received but it is slow, when I tried to search 13:00 event, it still receiving 11:00 security event

![log%20chart](https://us1.discourse-cdn.com/elastic/original/3X/b/d/bdfc577b0403e9393e2bc06d753bb8770abf70d3.png)

- May I know is there any limitation on winlogbeat?
- is it need to wait one machine event complete receiving to start receive other machine event.
- May I know why the log has delay?

Thanks

---

<div class="post-metadata">

**Author:** ![peterch](https://avatars.discourse-cdn.com/v4/letter/p/e5b9ba/32.png) [@peterch](https://discuss.elastic.co/u/peterch)\
**Post date:** [October 31, 2018, 8:24am UTC](https://discuss.elastic.co/t/winlogbeat-collect-active-directory-security-event-log-slowly/154380/2 "2018-10-31T08:24:13Z")

</div>

Anyone can answer?

---

<div class="post-metadata">

**Author:** ![Andrew\_Cholakian1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrew_cholakian1/32/3612_2.png) [@Andrew\_Cholakian1](https://discuss.elastic.co/u/Andrew_Cholakian1)\
**Post date:** [November 1, 2018, 5:32pm UTC](https://discuss.elastic.co/t/winlogbeat-collect-active-directory-security-event-log-slowly/154380/3 "2018-11-01T17:32:04Z")

</div>

Have you looked at the winlogbeat logs? Do you see any errors there?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 29, 2018, 5:32pm UTC](https://discuss.elastic.co/t/winlogbeat-collect-active-directory-security-event-log-slowly/154380/4 "2018-11-29T17:32:11Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.