topic Re: How to get a reasonable input for WindowsUpdateLog on Windows 10 and Server 2016? in All Apps and Add-ons

How to get a reasonable input for WindowsUpdateLog on Windows 10 and Server 2016?

hettervik — Thu, 30 Apr 2020 12:44:59 GMT

The Splunk Add-on for Windows has changed the way it reads the WindowsUpdateLog from tailing a log file to using a PowerShell script. The changes are explained here. However, the output from the Get-WindowsUpdateLog command has no value, and doesn't seem to be outputting the correct logs. The logs I'm getting looks something like the following.

1600/12/31 19:00:00.0000000 768   3764                  Unknown( 10): GUID=638e22b1-a858-3f40-8a43-af2c2ff651a4 (No Format Information found).
1600/12/31 19:00:00.0000000 768   3764                  Unknown( 11): GUID=bce7cceb-de62-3b09-7f4f-c69b1344a134 (No Format Information found).
1600/12/31 19:00:00.0000000 768   3764                  Unknown( 11): GUID=638e22b1-a858-3f40-8a43-af2c2ff651a4 (No Format Information found).
1600/12/31 19:00:00.0000000 768   3764                  Unknown( 50): GUID=6ffec797-f4d0-3bda-288a-dbf55dc91e0b (No Format Information found).

I also found a thread on another forum were somone seems to be having the same problem, but found no fix.

Anyone have encountered the same problem? Is there any workaround?

Re: How to get a reasonable input for WindowsUpdateLog on Windows 10 and Server 2016?

tauliang — Tue, 05 May 2020 04:38:55 GMT

What seemed to be the issue? I ran the powershell command on a Windows 10 box and got this

2020/05/03 13:59:26.9012287 3660  3744  DownloadManager Queueing update 5A85CA90-4A7B-4CF2-A1EE-0F457C832095.1 for download handler request generation.
2020/05/03 13:59:26.9015056 3660  3744  DownloadManager Handler can skip block validation for update 5A85CA90-4A7B-4CF2-A1EE-0F457C832095.1
2020/05/03 13:59:26.9039594 3660  11408 DownloadManager Disabling chunked mode for download. updateid: 5A85CA90-4A7B-4CF2-A1EE-0F457C832095.1
2020/05/03 13:59:26.9039675 3660  11408 DownloadManager Generating download request for update 5A85CA90-4A7B-4CF2-A1EE-0F457C832095.1.
2020/05/03 13:59:26.9051260 3660  11408 DownloadManager Calling into handler 0x9 to generate download request for update 5A85CA90-4A7B-4CF2-A1EE-0F457C832095.1.
2020/05/03 13:59:26.9083917 3660  11408 DownloadManager Found existing StreamingDataSource for update {5A85CA90-4A7B-4CF2-A1EE-0F457C832095} [d:EE659EBE]
2020/05/03 13:59:26.9085315 3660  11408 Handler         AppX GDR: Existing deployment operation for 5A85CA90-4A7B-4CF2-A1EE-0F457C832095
2020/05/03 13:59:26.9085362 3660  11408 Handler         AppX GDR: Waiting 0 ms for download execute or completion event.
2020/05/03 13:59:26.9085413 3660  11408 Handler         AppX GDR: WAIT_TIMEOUT seen. Wait timed out.
2020/05/03 13:59:26.9085614 3660  11408 DownloadManager GenerateDownloadRequest returned WU_E_OPERATIONINPROGRESS for update 5A85CA90-4A7B-4CF2-A1EE-0F457C832095.1.
2020/05/03 13:59:26.9589331 3660  31768 DownloadManager Dynamic download data fetcher for ServiceId 7971F918-A847-4430-9279-4A52D1EFE18D does not exist.
2020/05/03 13:59:30.4371243 3660  31768 DownloadManager Dynamic download data fetcher for ServiceId 7971F918-A847-4430-9279-4A52D1EFE18D does not exist.
2020/05/03 13:59:30.7685639 3660  3744  DownloadManager Handler returned total download size for update 5A85CA90-4A7B-4CF2-A1EE-0F457C832095.1 (session data (null)) as 47893581

How did the symbols get corrupted? This sounds like a Windows admin question to me.

Re: How to get a reasonable input for WindowsUpdateLog on Windows 10 and Server 2016?

hettervik — Thu, 07 May 2020 13:52:59 GMT

Thanks. I've looked into it some more myself. The script Splunk is using seems to be working as intended, it's the output from the Get-WindowsUpdateLog command in PowerShell that doesn't give any valuable outputs. I can't figure out why though. The symbols are not corrupted (see original post), it's just that there seems to be an issue with compatibility or something.

Re: How to get a reasonable input for WindowsUpdateLog on Windows 10 and Server 2016?

jhornsby_splunk — Thu, 07 May 2020 14:26:14 GMT

Hi @hettervi,

Out of interest, what user is Splunk running as in this case?

Cheers,

- Jo.

Re: How to get a reasonable input for WindowsUpdateLog on Windows 10 and Server 2016?

hettervik — Sat, 14 Nov 2020 17:34:27 GMT

Bit late here, but it runs as the default Local System user.

Re: How to get a reasonable input for WindowsUpdateLog on Windows 10 and Server 2016?

qescanciano — Thu, 03 Jun 2021 14:21:18 GMT

I have the same problem with Windows Server2016.

I don't find any fix...

Re: How to get a reasonable input for WindowsUpdateLog on Windows 10 and Server 2016?

ManjunathN — Thu, 12 Jan 2023 21:49:24 GMT

Hi @tauliang , @hettervik

Was this fixed by any chance?

Having same kind of issues of no format information found on the 2016 servers.

Can someone help on this topic please.

Thanks!