We've been using Winlogbeat to forward Workstation logs to Logstash. However, we've encountered an issue after installing Winlogbeat (versions 8.9.2 and 8.10.0) on our Windows Server 2022.
The issue is as follows:
Exception 0xc0000005 0x1 0x0 0x7ff80058e254
PC=0x7ff80058e254
runtime.cgocall(0x290120, 0xc0001006c0)
runtime/cgocall.go:157 +0x4a fp=0xc00034ac00 sp=0xc00034abc8 pc=0x224d4a
syscall.SyscallN(0xc0000caa80?, {0xc00034ac98?, 0xc00034acf0?, 0xc0003dfa40?})
runtime/syscall_windows.go:557 +0x109 fp=0xc00034ac78 sp=0xc00034ac00 pc=0x28b0c9
syscall.Syscall9(0x29c7be?, 0xc0001bd340?, 0xc0003f62d0?, 0x23?, 0x0?, 0x0?, 0xc0003f2510?, 0x1?, 0x1?, 0x0, ...)
runtime/syscall_windows.go:507 +0x78 fp=0xc00034acf0 sp=0xc00034ac78 pc=0x28add8
github.com/elastic/beats/v7/winlogbeat/sys/wineventlog._EvtFormatMessage(0x23?, 0x3600700?, 0x0, 0x0, 0xc000d5e978?, 0x1, 0x0, 0x0?, 0x0?)
github.com/elastic/beats/v7/winlogbeat/sys/wineventlog/zsyscall_windows.go:132 +0xf2 fp=0xc00034ad98 sp=0xc00034acf0 pc=0x177f152
github.com/elastic/beats/v7/winlogbeat/sys/wineventlog.evtFormatMessage(0xc0003f62d0?, 0x23?, 0x0?, {0x0?, 0x0, 0x1?}, 0x1?)
github.com/elastic/beats/v7/winlogbeat/sys/wineventlog/format_message.go:81 +0xa5 fp=0xc00034ae88 sp=0xc00034ad98 pc=0x176f645
github.com/elastic/beats/v7/winlogbeat/sys/wineventlog.getMessageString(0xc0003dfa40?, 0x4000?, 0x4000?, {0x0?, 0xc00034af08?, 0x3?})
github.com/elastic/beats/v7/winlogbeat/sys/wineventlog/format_message.go:57 +0x45 fp=0xc00034aed0 sp=0xc00034ae88 pc=0x176f4e5
github.com/elastic/beats/v7/winlogbeat/sys/wineventlog.getMessageStringFromHandle(...)
github.com/elastic/beats/v7/winlogbeat/sys/wineventlog/format_message.go:33
github.com/elastic/beats/v7/winlogbeat/sys/wineventlog.Message(0x4000?, {0xc0005e8000?, 0x36006e0?, 0xc0005623a0?}, 0xc00034afc8)
github.com/elastic/beats/v7/winlogbeat/sys/wineventlog/wineventlog_windows.go:274 +0x12c fp=0xc00034afa0 sp=0xc00034aed0 pc=0x177d5cc
github.com/elastic/beats/v7/winlogbeat/eventlog.newWinEventLog.func5(0xc0003a6000?)
github.com/elastic/beats/v7/winlogbeat/eventlog/wineventlog.go:289 +0x55 fp=0xc00034afe8 sp=0xc00034afa0 pc=0x2538735
github.com/elastic/beats/v7/winlogbeat/eventlog.(*winEventLog).Read(0xc0003a6000)
github.com/elastic/beats/v7/winlogbeat/eventlog/wineventlog.go:474 +0x81a fp=0xc00034b658 sp=0xc00034afe8 pc=0x253a1fa
github.com/elastic/beats/v7/winlogbeat/beater.(*eventLogger).run(0xc0006469c0, 0xc0004dade0, {0x361dff8?, 0xc000128500}, {{0xc00041ac60, 0xb}, 0xa49c728, {0xb23705c, 0xedc963e90, 0x0}, ...}, ...)
github.com/elastic/beats/v7/winlogbeat/beater/eventlogger.go:177 +0x10de fp=0xc00034bed8 sp=0xc00034b658 pc=0x25414de
github.com/elastic/beats/v7/winlogbeat/beater.(*Winlogbeat).processEventLog(0xc000277500?, 0x0?, 0x0?, {{0xc00041ac60, 0xb}, 0xa49c728, {0xb23705c, 0xedc963e90, 0x0}, {0xc0000565b0, ...}}, ...)
github.com/elastic/beats/v7/winlogbeat/beater/winlogbeat.go:215 +0xb3 fp=0xc00034bf70 sp=0xc00034bed8 pc=0x2543bb3
github.com/elastic/beats/v7/winlogbeat/beater.(*Winlogbeat).Run.func3()
github.com/elastic/beats/v7/winlogbeat/beater/winlogbeat.go:183 +0x55 fp=0xc00034bfe0 sp=0xc00034bf70 pc=0x2543935
runtime.goexit()
runtime/asm_amd64.s:1598 +0x1 fp=0xc00034bfe8 sp=0xc00034bfe0 pc=0x28e781
created by github.com/elastic/beats/v7/winlogbeat/beater.(*Winlogbeat).Run
github.com/elastic/beats/v7/winlogbeat/beater/winlogbeat.go:183 +0x3da
Could someone please assist us in identifying and resolving this problem?
Regards
Rishabh