# Winlogbeat ignores registry file with forwarded events **URL:** \ **Category:** Beats\ **Tags:** winlogbeat\ **Created:** [February 27, 2017, 10:01am UTC](https://discuss.elastic.co/t/winlogbeat-ignores-registry-file-with-forwarded-events/76601 "2017-02-27T10:01:06Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![dandrestor](https://avatars.discourse-cdn.com/v4/letter/d/7cd45c/32.png) [@dandrestor](https://discuss.elastic.co/u/dandrestor)\ **Post date:** [February 27, 2017, 10:01am UTC](https://discuss.elastic.co/t/winlogbeat-ignores-registry-file-with-forwarded-events/76601/1 "2017-02-27T10:01:06Z")
Hi there I think I discovered a bug and wanted the community's opinion before I submit an issue on GitHub. First, this only happens with forwarded events. I haven't been able to reproduce with locally generated events. - When starting winlogbeat, if the [registry file](https://www.elastic.co/guide/en/beats/winlogbeat/5.x/configuration-winlogbeat-options.html#_registry_file) does not exist, then it starts processing all events in the monitored event log from the beginning as would be expected. - If the registry file does exist, even if the timestamp/record\_number saved is in the past by, say, several minutes, winlogbeat will not resume at that point. Rather, it starts processing events that are just coming in. Events that are between the timestamp saved in the registry file, and the moment that winlogbeat is started, are lost. Can anybody else reproduce this? Or maybe I'm doing something wrong? I'm running Winlogbeat 5.0.2 on Windows 2012 R2. Thanks, Dan ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [February 27, 2017, 2:01pm UTC](https://discuss.elastic.co/t/winlogbeat-ignores-registry-file-with-forwarded-events/76601/2 "2017-02-27T14:01:40Z")
I think we need the enhancement I refer to in [https://github.com/elastic/beats/issues/1054#issuecomment-200548820](https://github.com/elastic/beats/issues/1054#issuecomment-200548820) to fix this (store XML bookmarks created by the CreateBookmark function in Windows). The registry file stores the latest value from the record\_number field. The record\_number field is normally a one up counter. But that assumption is broken with ForwardedEvents because it mixes events from multiple logs and hosts. My theory is that since it stores the latest record\_number it's possible that it could read an event with record\_number=10 followed by record\_number=5. Then on restart it reads from record\_number=5 causing some duplication. One workaround would be to use Logstash with [fingerprint](https://www.elastic.co/guide/en/logstash/current/plugins-filters-fingerprint.html) filter to create the `_id` field based on the event's @timestamp + computer\_name + log\_name + record\_number. (@timestamp comes from the event record and not the time Winlogbeat read the event so it's safe to use in a fingerprint.) ---
**Author:** ![dandrestor](https://avatars.discourse-cdn.com/v4/letter/d/7cd45c/32.png) [@dandrestor](https://discuss.elastic.co/u/dandrestor)\ **Post date:** [February 28, 2017, 7:41am UTC](https://discuss.elastic.co/t/winlogbeat-ignores-registry-file-with-forwarded-events/76601/3 "2017-02-28T07:41:25Z")
I think what you are describing is a possibly related, but separate problem. I also observed this - Winlogbeat will lose some events during normal operation, if events from multiple hosts are mixed in the same event log "box", I noticed. However, the problem that I am describing, I was able to reproduce it by using a single forwarded host - in this scenario, the record\_number progression would be consistent across Winlogbeat restarts. Would you be willing to try and reproduce this? ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [March 1, 2017, 4:17pm UTC](https://discuss.elastic.co/t/winlogbeat-ignores-registry-file-with-forwarded-events/76601/4 "2017-03-01T16:17:23Z")
> [@dandrestor](#): > > the record\_number progression would be consistent across Winlogbeat restarts I think this assumption is wrong. Can you check the data in event viewer? Each event log has its own record\_number counter. So multiple logs (Application, Security) being forwarded from a single host are enough to cause the problem. ---
**Author:** ![dandrestor](https://avatars.discourse-cdn.com/v4/letter/d/7cd45c/32.png) [@dandrestor](https://discuss.elastic.co/u/dandrestor)\ **Post date:** [March 1, 2017, 8:12pm UTC](https://discuss.elastic.co/t/winlogbeat-ignores-registry-file-with-forwarded-events/76601/5 "2017-03-01T20:12:00Z")
Fair point, to be honest I hadn't thought of that. However as it happens I'm forwarding only the Security event log from that particular host, so the record\_numbers should be in sequence. ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [March 1, 2017, 8:36pm UTC](https://discuss.elastic.co/t/winlogbeat-ignores-registry-file-with-forwarded-events/76601/6 "2017-03-01T20:36:35Z")
I think I know why this is happening. It's all caused by the same problem - the fact that we don't store an XML bookmark. When resuming it creates a bookmark based on the configured name of the log which is ForwardedEvents. Windows doesn't know what to do with that information since there are no records matching that log name. ---
**Author:** ![dandrestor](https://avatars.discourse-cdn.com/v4/letter/d/7cd45c/32.png) [@dandrestor](https://discuss.elastic.co/u/dandrestor)\ **Post date:** [March 7, 2017, 6:19am UTC](https://discuss.elastic.co/t/winlogbeat-ignores-registry-file-with-forwarded-events/76601/7 "2017-03-07T06:19:25Z")
Do you think this could also be causing events to be lost by Winlogbeat during normal operation (i.e. no restarts involved)? I'm seeing some discrepancies. I opened [https://github.com/elastic/beats/issues/3731](https://github.com/elastic/beats/issues/3731) for this (Winlogbeat losing events during normal operation) and referenced this discussion as a possibly related. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 4, 2017, 6:19am UTC](https://discuss.elastic.co/t/winlogbeat-ignores-registry-file-with-forwarded-events/76601/8 "2017-04-04T06:19:57Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.