In UniversalForwarder 10.0.0.0, splunk-winevtlog.exe process consumes all memory and crashes the server

[darren]

We recently updated 4 DEV servers with UniversalForwarder 10.0.0.0.  However, on one of them the splunk-winevtlog.exe process consumes all memory and crashes the server within a few minutes of boot up.   That one server that is crashing runs some java services, which may or may not be related.  We're going to downgrade to UF 9.4.4.0 for now.

[darren]

Thanks, we'll test out the fix you linked to.

[kiran_panchavat]

@darrenWhat does the splunkd.log show after the UF has crashed?

[kiran_panchavat]

@darren 

Check this https://community.splunk.com/t5/Splunk-Enterprise/URGENT-All-splunk-forwarders-upgraded-to-10-0-vers... 

Disabled the

evt_resolve_ad_obj = 0

in Splunk_TA_windows app , logs have now ceased.