topic Re: How to troubleshoot why Splunk stopped indexing WMI Windows Security Events? in Getting Data In

How to troubleshoot why Splunk stopped indexing WMI Windows Security Events?

rbal_splunk — Sun, 31 May 2015 05:00:12 GMT

Splunk stopped receiving Windows Security Event using WMI.
This has been working for year; also issue is only with security event all other channel are still being ingested using WMI.

Re: How to troubleshoot why Splunk stopped indexing WMI Windows Security Events?

rbal_splunk — Sun, 31 May 2015 05:03:46 GMT

For such issues my Suggestion will be for you to enable following debugging on the instance of Splunk where these WMI dats is being ingested.
To enable tracing please use http://wiki.splunk.com/Community:TroubleshootingWMIIssues as suggested in the document you need to enable following followed by restart of splun kinstance.

In $SPLUNK_HOME/etc/log.cfg:
category.ExecProcessor=DEBUG

$SPLUNK_HOME/etc/logcmdline.cfg:
category.WMI=DEBUG

After that check if Splunkd.log shows message like rec-id hits the limit of unsigned int type:

05-15-2015 13:24:11.809 -0400 DEBUG ExecProcessor - message from ""C:\Program Files\Splunk\bin\splunk-wmi.exe"" WMI - EventLogQueryProcessor::writeData: Reseting DESC: chk=4294967295, low=1033239786, hi=4294967295 (co1-dfsprd33.tampa.healthe: Security)

The limit of unsigned int is 4294967295 (0xffffffff).

Here's a link for the limitation of Microsoft WQL api:

https://social.technet.microsoft.com/Forums/windowsserver/en-US/78e6d555-0f5d-4def-92d5-14d3ad6ee558/eventlog-problems-with-query

As stated in the link, the rec ids are limited to 32 bit unsigned int. WMI does not work if the rec id goes beyond that point.
Due to this limitation instead of using wmi suggestion will be to install Universal Forwarder at sources to ingest data that is currently ingested using WMI.

Re: How to troubleshoot why Splunk stopped indexing WMI Windows Security Events?

m4him7 — Sun, 31 May 2015 12:42:45 GMT

The link that rbal_splunk gave seems to be broken. I found it here:
http://wiki.splunk.com/Community:TroubleshootingWMIIssues
although it seems to be the same link except a comma got stuck on the end of the link.

Re: How to troubleshoot why Splunk stopped indexing WMI Windows Security Events?

peterchow — Mon, 31 Jul 2017 08:50:50 GMT

Hi rbal,

For the wmi issue, is it possible to reset the record?

Thanks

Best REgards,
Peter