After upgrading to UF 10.0 we see many Application Error (EventCode=1000) crashes on a subset of servers only. Faulting modules vary between KERNELBASE.dll (system) and VCRUNTIME140.dll (sometimes loaded from UF bin). Examples Faulting app: splunk-winevtlog.exe 2560.0.26759.23473 Faulting module: KERNELBASE.dll 10.0.17763.7553 Exception code: 0xeeab5254 Path: C:\Windows\System32\KERNELBASE.dll Faulting app: splunk-winevtlog.exe 2560.0.26759.23473 Faulting module: VCRUNTIME140.dll 14.42.34438.0 Path: C:\Program Files\SplunkUniversalForwarder\bin\VCRUNTIME140.dll Exception code: 0xc0000005 Questions - Does UF 10.0 ship and prefer its own VCRUNTIME140.dll, or should it rely on system VC++ Redistributable? - Any known compatibility issues with specific KERNELBASE.dll builds (e.g., Server 2019 17763.x) for splunk-winevtlog.exe? - What VC++ Redistributable version is required/recommended for UF 10.0 (x64/x86)? Any compatibility matrix? - Any known bugs/hotfixes for these crashes in UF 10.0? Note: Problematic hosts seem to have older runtime builds than the working ones. Thanks for any pointers/docs!
... View more
