Winlogbeat stops sending logs

Elastic Stack Beats
1

Hello,
We are collecting events from DCs and somehow lately winlogbeat stopps sending them on multiple devices.

I did set logging for debug
logging.level: debug
logging.to_file: true
logging.files:
path: 'C:\Program Files\WinLogbeat\Logs'
name: winlogbeat
keepfiles: 7
rotateeverybytes: 10485760

But there is no error log it just breaks. Is there anything else I could check to solve this case?

2

When we restart service it starts collecting them again. This time it stopped after 2 hours.

In the log something like this, like it would stop checking event log

2023-06-23T11:55:59.634+0200 DEBUG [eventlog_detail] eventlog/wineventlog.go:296 WinEventLog[System] No more events
2023-06-23T11:55:59.634+0200 DEBUG [winlogbeat] beater/eventlogger.go:158 EventLog[System] Read() returned 0 records
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.