search

elastic / elastic-agent

Elastic Agent - single, unified way to add monitoring for logs, metrics, and other types of data to a host.
Other
131 stars 139 forks source link

Encountered channel not found error on adding Windows integration to the Windows agent. #5746

Open amolnater-qasource opened 1 week ago

amolnater-qasource commented 1 week ago

Kibana Build details:

VERSION: 8.16.0 SNAPSHOT
BUILD: 78938
COMMIT: 7b832691e8b07c67b411da95b0398a04711da864

Artifact: https://snapshots.elastic.co/8.16.0-39df64b4/downloads/beats/elastic-agent/elastic-agent-8.16.0-SNAPSHOT-windows-x86_64.zip

Image

Host: Windows Server 2022- Test Signing ON

Preconditions:

  1. 8.16.0 SNAPSHOT Kibana cloud environment should be available.
  2. Agent should be installed with policy having System and Windowsintegrations.

Steps to reproduce:

  1. Navigate to Agents tab.
  2. Observe the Agent gets unhealthy and navigate to policy details page.
  3. Observe error for Windows integration: Encountered channel not found error

Expected Result: No error should be displayed on adding Windows integration to the Windows agent.

Logs: elastic-agent-diagnostics-2024-10-09T06-48-15Z-00.zip

Screenshots: Image Image

elasticmachine commented 1 week ago

Pinging @elastic/elastic-agent-control-plane (Team:Elastic-Agent-Control-Plane)

amolnater-qasource commented 1 week ago

@muskangulati-qasource Please review.

muskangulati-qasource commented 1 week ago

Secondary review is done for this ticket!

cmacknz commented 1 week ago

I see this is privileged/admin agent looking in agent-info.yaml:

agent_id: 881c5687-32af-4bf9-b62f-4b74f2f688ec
headers: {}
log_level: info
snapshot: true
unprivileged: false
version: 8.16.0

Also that this is coming from the winlog input. Tagging @nfritts and @elastic/sec-windows-platform.

            input-winlog-default-winlog-windows-4ea5f67a-48fc-41ea-b586-2a29eac6423a:
                message: 'Encountered channel not found error when opening Windows Event Log: The specified channel could not be found.'
                payload:
                    streams:
                        winlog-windows.forwarded-4ea5f67a-48fc-41ea-b586-2a29eac6423a:
                            error: ""
                            status: HEALTHY
                        winlog-windows.powershell-4ea5f67a-48fc-41ea-b586-2a29eac6423a:
                            error: ""
                            status: HEALTHY
                        winlog-windows.powershell_operational-4ea5f67a-48fc-41ea-b586-2a29eac6423a:
                            error: ""
                            status: HEALTHY
                        winlog-windows.sysmon_operational-4ea5f67a-48fc-41ea-b586-2a29eac6423a:
                            error: 'Encountered channel not found error when opening Windows Event Log: The specified channel could not be found.'
                            status: DEGRADED