After a change to inputs.conf to get Windows security event logs, why am I getting error "Failed to checkpoint for channel='security'"?

[abovebeyond]

Hello,

I've changed some whitelist parameters in the inputs.conf file to index Windows security event logs, however, I'm seeing the error:

message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe"" splunk-winevtlog - WinEventMon::processLogChannel: Failed to checkpoint for channel='security'

What is the problem?

Thanks!

[abovebeyond · Accepted solution]

i think i fixed it, stopped the service for few second and start it again. Thanks !

[splunker12er]

Check out this.. http://answers.splunk.com/answers/129420/wineventmon-processlogchannel-unable-to-checkpoint.html

[bmacias84]

Does your forwarder run as different user other than system? If so you may have permission issue. Other wise post a input stanza.