Drop in Windows Events After installing 10.6.6.1

[david_waugh]

Good Morning.

I installed 10.6.6.1 on June 12th. Last week I noticed that an ESA rule had not fired and on investigating I can see that there was a correlation between the upgrade and a drop in Windows events.

The graph below shows winevent logon for a service account that polls at regular intervals. In the part highlighted in yellow, i performed the upgrade and after this you can see that there was a drop of in Windows events.

I double checked that the delay is not due to actually collecting events on the Windows size, as the amount of messages collected on the log collectors was constant with no spikes.

Due to a historic issue we restart our logcollector service every night at 1:42. I notice that there was a spike of Windows events at this time.

After scheduling a restart of the windows event collector service on the hour, the events seems to flow correctly.

I used the following script saved in /etc/cron.hourly/RestartWindowsCollection.sh do this

NwConsole -c "login localhost:50001 admin netwitness" -c "send /logcollection/windows stop" -c "send /logcollection/windows start"

Has anyone else observed this behaviour?

[david_waugh · Accepted solution]

I think something might have changed after the upgrade, but one main reason for this was that I had "Debug=Verbose" configured on the Windows Event Collectors.

The reason I needed to do this was to extract non standard windows messages, but we have solved this requirement in another way now.