Closed hugalafutro closed 1 year ago
@Graylog2/seccon This is probably because of the old winlogbeat version we ship in sidecar. (7.11) Can you please check if you can reproduce the issue? Thank you!
For what it's worth, both machines were using sidecar 1.1.0 for the longest time, survived update from win10 to win11 etc. Then I noticed this problem I'd say between a week and month ago, and updated sidecar on both machines to 1.2.0 with no change in behaviour just before posting this issue. Winlogbeat.exe is 7.11.1 on both the working and non-working machine.
it seems the Windows 11 update 22H2 is the culprit, the working PC just finished updating to it and after reboot sends the messages with %1 %2 %3 etc now too.
Confirming i see the same behavior with Windows 11 22H2.
For what its worth i can still replicate this issue using the latest version of Winlogbeat, 8.5.0.
I did some cursory searching on the internet and cannot find any acknowledgement from elastic that this issue exists. I did post on their community forum to see if its possible a fix is in the works but just not publicly disclosed.
After updating some components the issue is still replicable in Graylog 5.0.0-rc.2+6a55921, with Sidecars 1.2.0 and 1.3.0-beta.1
@hugalafutro The issue is not related to Graylog or Sidecar. There seems to be an issue with winlogbeat and newer Windows versions. This is nothing we can fix in our products.
@bernd Thanks for letting me know, am I correct in assuming I should report the issue at https://github.com/elastic/beats/issues then?
A user's local group membership was enumerated. Subject: Security ID: %4
@hugalafutro Please try to update to the latest winlogbeat first. The issue might be fixed already. :slightly_smiling_face: The version we ship in our Sidecar for Windows is outdated. We are looking into updating it soon.
@bernd I have tried with winlogbeat 8.5.2 released 7 days ago, but the issue is the same, I shall open the issue at elastic later (gotta do laundry first 😄)
for reference this is an example event from graylog with winlogbeat 8.5.2 https://o.o5.ddns.net/8x90h
I'm not sure if you want me to close this or leave it open until it is actually resolved even though it is not actually graylog issue, let me know.
edit: I have found the issue at elastic, although only in their unconfirmed bugs section https://discuss.elastic.co/t/winlogbeat-8-5-and-windows-11-22h2/318676/3
Confirmed that winlogbeat 8.6.0 does not resolve this issue.
For reference, the issue at elastic https://github.com/elastic/beats/issues/33966
@mpfz0r This is most likely a bug in Windows 11 22H2. We are in contact with Microsoft about it.
@bernd I have just done some digging in winlogbeat to follow what is happening here and am fairly confident that this is a Windows 11 issue (summary of investigation here). Have you had any response from MS?
@bernd I have just done some digging in winlogbeat to follow what is happening here and am fairly confident that this is a Windows 11 issue (summary of investigation here). Have you had any response from MS?
@efd6 I agree. This looks like a Windows 11 issue to me as well. It works correctly with Windows 10 22H2 and Windows 11 21H2. It breaks since Windows 11 22H2.
We don't have a response from Microsoft yet.
Quick verification check, are y'all able to reproduce this issue? I just tried with Windows 11 10.0.19044.2728 (March 2023 patch level) and no longer experience this issue. Want to confirm though.
Ignore, i was confused and wrong :(
Quick verification check, are y'all able to reproduce this issue? I just tried with Windows 11 10.0.19044.2728 (March 2023 patch level) and no longer experience this issue. Want to confirm though.
My last test was in February. So they might have fixed the issue in a newer version. That would be great. :slightly_smiling_face:
Ok, i really messed that testing up 🫠. It had been so long that I forgot specifically which windows device I was testing with and then re-tested with a windows 10 device that never had this issue.
So to clarify, the issue still exists, and still occurs with the latest Winlogbeat 8.7.1. Sorry for the confusion!
Any solution for the problem?
Via https://github.com/elastic/beats/issues/33966#issuecomment-1570019443
Microsoft have advised us that what we're seeing is a known issue and was addressed in an update released on May 24th - KB5026446. The update is currently an optional update, but will be included in next month's Patch Tuesday.
I independently tested this and can confirm it does resolve this issue!
Can we close this issue then? Not a bug on our side and MS provided a fix
We can. Bug on microsoft side and took them ~8 months to fix 🙃
Problem description
I have 2 Windows 11 machines with sidecar installed with identical config. Both worked as expected, but recently (can't pinpoint the exact time) I noticed one of them sends all meaningful data as %1, %2, %3 etc instead.
example:
Steps to reproduce the problem
Environment
winlogbeat config on graylog side:
sidecar.yml from the offending machine: