topic Re: In UniversalForwarder 10.0.0.0, splunk-winevtlog.exe process consumes all memory and crashes the server in Splunk Enterprise

In UniversalForwarder 10.0.0.0, splunk-winevtlog.exe process consumes all memory and crashes the server

darren — Fri, 22 Aug 2025 15:21:35 GMT

We recently updated 4 DEV servers with UniversalForwarder 10.0.0.0. However, on one of them the splunk-winevtlog.exe process consumes all memory and crashes the server within a few minutes of boot up. That one server that is crashing runs some java services, which may or may not be related. We're going to downgrade to UF 9.4.4.0 for now.

Re: In UniversalForwarder 10.0.0.0, splunk-winevtlog.exe process consumes all memory and crashes the server

kiran_panchavat — Fri, 22 Aug 2025 16:59:03 GMT

@darren

Check this https://community.splunk.com/t5/Splunk-Enterprise/URGENT-All-splunk-forwarders-upgraded-to-10-0-version-are/td-p/751274

Disabled the

evt_resolve_ad_obj = 0

in Splunk_TA_windows app , logs have now ceased.

Re: In UniversalForwarder 10.0.0.0, splunk-winevtlog.exe process consumes all memory and crashes the server

kiran_panchavat — Fri, 22 Aug 2025 17:07:26 GMT

@darrenWhat does the splunkd.log show after the UF has crashed?

Re: In UniversalForwarder 10.0.0.0, splunk-winevtlog.exe process consumes all memory and crashes the server

darren — Mon, 25 Aug 2025 13:43:46 GMT

Thanks, we'll test out the fix you linked to.