# Winlogbeat was mistakenly killed by 360 antivirus software, how to solve it **URL:** \ **Category:** Beats\ **Tags:** winlogbeat\ **Created:** [March 20, 2025, 3:54am UTC](https://discuss.elastic.co/t/winlogbeat-was-mistakenly-killed-by-360-antivirus-software-how-to-solve-it/376156 "2025-03-20T03:54:25Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![shaohuan](https://avatars.discourse-cdn.com/v4/letter/s/90db22/32.png) [@shaohuan](https://discuss.elastic.co/u/shaohuan)\ **Post date:** [March 20, 2025, 3:54am UTC](https://discuss.elastic.co/t/winlogbeat-was-mistakenly-killed-by-360-antivirus-software-how-to-solve-it/376156/1 "2025-03-20T03:54:25Z")
When the program is running, it is always mistakenly killed by 360 antivirus software ---
**Author:** ![NickFritts](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nickfritts/32/47189_2.png) [@NickFritts](https://discuss.elastic.co/u/NickFritts)\ **Post date:** [March 24, 2025, 7:43pm UTC](https://discuss.elastic.co/t/winlogbeat-was-mistakenly-killed-by-360-antivirus-software-how-to-solve-it/376156/2 "2025-03-24T19:43:13Z")
Hello shaohuan, Do you have any screenshots or logs that you could provide? Thanks! ---
**Author:** ![shaohuan](https://avatars.discourse-cdn.com/v4/letter/s/90db22/32.png) [@shaohuan](https://discuss.elastic.co/u/shaohuan)\ **Post date:** [March 25, 2025, 1:19am UTC](https://discuss.elastic.co/t/winlogbeat-was-mistakenly-killed-by-360-antivirus-software-how-to-solve-it/376156/3 "2025-03-25T01:19:28Z")
![image](https://us1.discourse-cdn.com/elastic/original/3X/f/8/f87600fb4b39a1adce7881e0d2be274eb8bd8bdc.png) ---
**Author:** ![NickFritts](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nickfritts/32/47189_2.png) [@NickFritts](https://discuss.elastic.co/u/NickFritts)\ **Post date:** [March 25, 2025, 9:47am UTC](https://discuss.elastic.co/t/winlogbeat-was-mistakenly-killed-by-360-antivirus-software-how-to-solve-it/376156/4 "2025-03-25T09:47:39Z")
Thank you @shaohuan. One last question, do you know which version of winlogbeat that is? And did you install it standalone or is it managed by agent? ---
**Author:** ![shaohuan](https://avatars.discourse-cdn.com/v4/letter/s/90db22/32.png) [@shaohuan](https://discuss.elastic.co/u/shaohuan)\ **Post date:** [March 26, 2025, 3:46am UTC](https://discuss.elastic.co/t/winlogbeat-was-mistakenly-killed-by-360-antivirus-software-how-to-solve-it/376156/5 "2025-03-26T03:46:22Z")
version is： winlogbeat version 8.17.0 (amd64), libbeat 8.17.0 [092f0eae4d0d343cc3a142f671c2a0428df67840 built 2024-12-11 11:10:44 +0000 UTC] install it standalone ---
**Author:** ![NickFritts](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nickfritts/32/47189_2.png) [@NickFritts](https://discuss.elastic.co/u/NickFritts)\ **Post date:** [April 1, 2025, 10:04am UTC](https://discuss.elastic.co/t/winlogbeat-was-mistakenly-killed-by-360-antivirus-software-how-to-solve-it/376156/6 "2025-04-01T10:04:25Z")
Thanks @shaohuan Are you still having a problem with this? I attempted to replicate it so that I could submit a false positive report to 360 AV, but its not alerting for me. If you're still having the problem could you hash your winlogbeat.exe and share that hash with me? Thanks, -nf ---
**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\ **Post date:** [April 1, 2025, 10:25am UTC](https://discuss.elastic.co/t/winlogbeat-was-mistakenly-killed-by-360-antivirus-software-how-to-solve-it/376156/7 "2025-04-01T10:25:40Z")
Add winlogbeat to safe app or path list. ---
**Author:** ![shaohuan](https://avatars.discourse-cdn.com/v4/letter/s/90db22/32.png) [@shaohuan](https://discuss.elastic.co/u/shaohuan)\ **Post date:** [April 2, 2025, 7:03am UTC](https://discuss.elastic.co/t/winlogbeat-was-mistakenly-killed-by-360-antivirus-software-how-to-solve-it/376156/8 "2025-04-02T07:03:15Z")
![hash](https://us1.discourse-cdn.com/elastic/original/3X/a/d/ad244d7173954607dd72c707bd1bf5f0bd913075.png) still having the problem ---
**Author:** ![NickFritts](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nickfritts/32/47189_2.png) [@NickFritts](https://discuss.elastic.co/u/NickFritts)\ **Post date:** [April 2, 2025, 9:37am UTC](https://discuss.elastic.co/t/winlogbeat-was-mistakenly-killed-by-360-antivirus-software-how-to-solve-it/376156/9 "2025-04-02T09:37:13Z")
Thank you @shaohuan. I've submitted a false positive report here: [False Positives/Suspicious | 360 Total Security](https://www.360totalsecurity.com/en/suspicion/false-positive/) In the meantime if you need to work around the issue, you might try a newer version of winlogbeat. there are a couple different patch versions of 8.17 that are out and maybe they won't get detected incorrectly. ---
**Author:** ![shaohuan](https://avatars.discourse-cdn.com/v4/letter/s/90db22/32.png) [@shaohuan](https://discuss.elastic.co/u/shaohuan)\ **Post date:** [April 2, 2025, 9:55am UTC](https://discuss.elastic.co/t/winlogbeat-was-mistakenly-killed-by-360-antivirus-software-how-to-solve-it/376156/10 "2025-04-02T09:55:29Z")
Thanks!