Winlogbeat Service won't start error 1067

[richard.andersson]

Hi,
Version we have tested with winlogbeat-7.7.1 and winlogbeat-6.8.10 and winlogbeat-7.6.0 and winlogbeat-6.5.0
OS: Windows Server 2016.

We have problem to start winlogbeat Service with error 1067

We have test start it manually (cmd as admin) and thats working good and logs are comming in to the server, we have also tried to do a test on the config (.\winlogbeat.exe test config -c .\winlogbeat.yml -e) and gets Ok

The problem is on ours Citrix XenApp servers, we have tested on a other server and it's working.

Could it be security rights on filsystem?

We have also testde to run the service with other user account but it's not working.

Log:
2020-06-11T13:49:42.033+0200 INFO instance/beat.go:616 Home path: [C:\Program Files\Winlogbeat] Config path: [C:\Program Files\Winlogbeat] Data path: [C:\ProgramData\winlogbeat] Logs path: [C:\ProgramData\winlogbeat\logs]
2020-06-11T13:49:42.040+0200 INFO instance/beat.go:623 Beat UUID: cffd861f-0fac-4a02-ba94-f9e8bed11981
2020-06-11T13:49:42.041+0200 INFO [beat] instance/beat.go:849 Beat info {"system_info": {"beat": {"path": {"config": "C:\Program Files\Winlogbeat", "data": "C:\ProgramData\winlogbeat", "home": "C:\Program Files\Winlogbeat", "logs": "C:\ProgramData\winlogbeat\logs"}, "type": "winlogbeat", "uuid": "cffd861f-0fac-4a02-ba94-f9e8bed11981"}}}
2020-06-11T13:49:42.041+0200 INFO [beat] instance/beat.go:858 Build info {"system_info": {"build": {"commit": "ff5b9b3db49856a25b5eda133b6997f2157a4910", "libbeat": "6.5.0", "time": "2018-11-09T18:09:19.000Z", "version": "6.5.0"}}}
2020-06-11T13:49:42.041+0200 INFO [beat] instance/beat.go:861 Go runtime info {"system_info": {"go": {"os":"windows","arch":"amd64","max_procs":4,"version":"go1.10.3"}}}
2020-06-11T13:49:42.055+0200 INFO [beat] instance/beat.go:865 Host info {"system_info": {"host": {"architecture":"x86_64","boot_time":"2020-06-11T13:45:56.66+02:00","name":"F52CXTPDEV2016","ip":["10.226.40.107/25","::1/128","127.0.0.1/8"],"kernel_version":"10.0.14393.3686 (rs1_release.200504-1524)","mac":["00:50:56:b1:25:67"],"os":{"family":"windows","platform":"windows","name":"Windows Server 2016 Standard","version":"10.0","major":10,"minor":0,"patch":0,"build":"14393.3686"},"timezone":"CEST","timezone_offset_sec":7200,"id":"6ef23554-fae4-40e8-b55c-c2850d18502e"}}}
2020-06-11T13:49:42.059+0200 INFO [beat] instance/beat.go:894 Process info {"system_info": {"process": {"cwd": "C:\Windows\system32", "exe": "C:\Program Files\Winlogbeat\winlogbeat.exe", "name": "winlogbeat.exe", "pid": 1244, "ppid": 1728, "start_time": "2020-06-11T13:49:41.688+0200"}}}
2020-06-11T13:49:42.059+0200 INFO instance/beat.go:302 Setup Beat: winlogbeat; Version: 6.5.0
2020-06-11T13:49:45.072+0200 INFO add_cloud_metadata/add_cloud_metadata.go:319 add_cloud_metadata: hosting provider type not detected.
2020-06-11T13:49:45.072+0200 INFO [publisher] pipeline/module.go:110 Beat name: F52CXTPDEV2016
2020-06-11T13:49:45.072+0200 INFO beater/winlogbeat.go:68 State will be read from and persisted to C:\ProgramData\winlogbeat.winlogbeat.yml
2020-06-11T13:49:45.072+0200 INFO instance/beat.go:424 winlogbeat start running.
2020-06-11T13:49:45.075+0200 INFO [monitoring] log/log.go:117 Starting metrics logging every 30s

/Richard

[jduke50 (James)]

I have the same problem on a 2016 server, running winlogbeat 7.7.1 and 7.8.0. Tried to use an interactive account with admin rights to test and still receive the error and the service will not start. The winlogbeat client will run manually.
I have changed the path to "c:\Program Files\winlogbeat", have tried to start the service with the verbose option and the output was minimal:

VERBOSE: Performing the operation "Start-Service" on target "winlogbeat (winlogbeat)".
Start-Service : Failed to start service 'winlogbeat (winlogbeat)'.
At line:1 char:1
+ Start-Service -DisplayName “winlogbeat” -Verbose
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : OpenError: (System.ServiceProcess.ServiceController:ServiceController) [Start-Service], ServiceCommandException
    + FullyQualifiedErrorId : StartServiceFailed,Microsoft.PowerShell.Commands.StartServiceCommand```