topic Why the ErrorCode 5 when trying to forward Sysmon logs (unable to subscribe)? in Installation

Why the ErrorCode 5 when trying to forward Sysmon logs (unable to subscribe)?

pck1983 — Mon, 18 Sep 2023 22:14:31 GMT

I got the following errors in my Splunk Error Logs:

Init failed, unable to subscribe to Windows Event Log channel Microsoft-Windows-Sysmon/Operational: errorCode=5

The UniversalForwarder is installed on a Windows 10 Desktop (not part of a Doamin).

I can see Sysmon logging in the eventlog viewer and I can forward the System and Security logs but not the Sysmon logs. What do I overlook here?

inputs.conf:

[WinEventLog://Security] disabled = 0 [WinEventLog://System] disabled = 0 [WinEventLog://Microsoft-Windows-Sysmon/Operational] disabled = 0

Re: Why the ErrorCode 5 when trying to forward Sysmon logs (unable to subscribe)?

mawni — Mon, 27 Nov 2023 11:00:28 GMT

It was due to the user being configured to run the Splunk forwarder Windows service. It was a local user account without the necessary rights. I changed it to a local system account and the events started to flow in.

Thanks,

Awni

Re: Why the ErrorCode 5 when trying to forward Sysmon logs (unable to subscribe)?

gazoscreek — Fri, 11 Oct 2024 17:28:55 GMT

May I ask how you changed the UF to run as System? Is it simply a case of setting SPLUNK_OS_USER in splunk-launch.conf like it would be on a linux host?

ie:
SPLUNK_OS_USER=SYSTEM

Thank you, and apologies if this is a really lame question.

Re: Why the ErrorCode 5 when trying to forward Sysmon logs (unable to subscribe)?

soberocean — Thu, 24 Oct 2024 15:16:00 GMT

Hey,

I had the same issue and I fixed it by changing the user through Services:

soberocean_0-1729782932885.png