topic Re: How to troubleshoot why Splunk is generating Eventcode=1035 events on our Splunk 6.2.2 Windows universal forwarder? in Getting Data In

How to troubleshoot why Splunk is generating Eventcode=1035 events on our Splunk 6.2.2 Windows universal forwarder?

jberd126 — Fri, 29 May 2015 16:13:14 GMT

Splunk appears to be calling "Win32_Product" WMI function that triggers a consistency check of installed applications causing numberous 1035 event codes to be generated in the event log (approximately 100 every 10 minutes). It appears to correlate nicely with perfmon queries.

eventtype="wineventlog_windows" sourcetype="WinEventLog:*" EventCode=1035 SourceName=MsiInstaller

I can confirm that, through PowerShell, executing "Get-WmiObject Win32_Product" does indeed trigger the 1035 events/

I've looked through our configs and have verified that we are not running a Win32_Product WMI query explicitly and I verified that running the Splunk command 'splunk-wmi' does not trigger the generation of 1035 events.

Not all machines exhibit this problem and we have not been able to determine a pattern on why some are affected and others are not.

Software

Windows Server 2012
Splunk Universal Forwarder 6.2.2

More information in Microsoft KB article:

Event log message indicates that the Windows Installer reconfigured all installed applications: https://support.microsoft.com/en-us/kb/974524

Re: How to troubleshoot why Splunk is generating Eventcode=1035 events on our Splunk 6.2.2 Windows universal forwarder?

jberd126 — Wed, 06 Jan 2016 20:52:37 GMT

This problem was fixed in Splunk 6.3.0. I've personally verified it with Splunk 6.3.2 Universal Forwarder.

Re: How to troubleshoot why Splunk is generating Eventcode=1035 events on our Splunk 6.2.2 Windows universal forwarder?

fairje — Thu, 28 Jan 2016 16:06:15 GMT

Note that the every 10 minutes issue for us appears to be tied to WinHostMon stanzas. The default interval for WinHostMon is every 10 minutes. Procmon is currently set to every 1 minute for us so I don't believe this to be causing the issue.

Re: How to troubleshoot why Splunk is generating Eventcode=1035 events on our Splunk 6.2.2 Windows universal forwarder?

mahantdesai — Wed, 07 Aug 2019 10:22:14 GMT

I have same problem. Applications Event logs are filled with multiple events with id 1035 generated by MsiInstaller. I upgraded Splunk from 7.0.0 to 7.3.1, still no use. We are running on Windows Server 2016. Any help would be much appreciated. Thanks in advance.

Re: How to troubleshoot why Splunk is generating Eventcode=1035 events on our Splunk 6.2.2 Windows universal forwarder?

mahantdesai — Wed, 07 Aug 2019 10:24:13 GMT

We have problem with splunk generating multiple events with event id 1035 generated by MsiInstaller. I have upgraded Splunk from 7.0.0 to 7.3.1, still no use. We are running on Windows Server 2016. Any help would be much appreciated. Thanks in advance.