1. Describe your incident:
I’m having issues with the Winlogbeat sidecar and no messages ever showing in the web console.
2. Describe your environment:
Single node running on a Ubuntu 22.04 LTS
Graylog 5.2
MongoDB 6
Opensearch 2.13
sidecar is 1.5.0.1
winlogbeat is 8.9 as well as 8.13
(Winlogbeat.conf)
output.logstash:
hosts: [“192.168.0.127:5044”]
path:
data: C:\Program Files\Graylog\sidecar\generated\6622d69439fc515d2219e98d\data
logs: C:\Program Files\Graylog\sidecar\generated\6622d69439fc515d2219e98d\logs
tags:
- windows
winlogbeat.event_logs:- name: Application
- name: System
- name: Security
- name: Setup
- name: ForwardedEvents
(sidecar.yml)
The URL to the Graylog server API.
Default: “http://127.0.0.1:9000/api/”
server_url: “http://192.168.0.127:9000/api”
The API token to use to authenticate against the Graylog server API.
Default: none
server_api_token: “token was generated”
The node ID of the sidecar. This can be a path to a file or an ID string.
If set to a file and the file doesn’t exist, the sidecar will generate an
unique ID and writes it to the configured path.
Example file path: “file:C:\Program Files\Graylog\sidecar\node-id”
Example ID string: “6033137e-d56b-47fc-9762-cd699c11a5a9”
ATTENTION: Every sidecar instance needs a unique ID!
Default: “file:C:\Program Files\Graylog\sidecar\node-id”
node_id: “file:C:\Program Files\Graylog\sidecar\node-id”
The node name of the sidecar. If this is empty, the sidecar will use the
hostname of the host it is running on.
Default: “”
node_name: “”
The update interval in secods. This configures how often the sidecar will
contact the Graylog server for keep-alive and configuration update requests.
Default: 10
update_interval: 10
This configures if the sidecar should skip the verification of TLS connections.
Default: false
tls_skip_verify: false
This enables/disables the transmission of detailed sidecar information like
collector statues, metrics and log file lists. It can be disabled to reduce
load on the Graylog server if needed. (disables some features in the server UI)
Default: true
send_status: true
A list of directories to scan for log files. The sidecar will scan each
directory for log files and submits them to the server on each update.
Example:
list_log_files:
- “/var/log/nginx”
- “/opt/app/logs”
Default: empty list
#list_log_files:
Directory where the sidecar stores internal data.
#cache_path: “C:\Program Files\Graylog\sidecar\cache”
Directory where the sidecar stores logs for collectors and the sidecar itself.
#log_path: “C:\Program Files\Graylog\sidecar\logs”
The maximum size of the log file before it gets rotated.
#log_rotate_max_file_size: “10MiB”
The maximum number of old log files to retain.
#log_rotate_keep_files: 10
How long to wait for the config validation command.
#collector_validation_timeout: “1m”
Directory where the sidecar generates configurations for collectors.
#collector_configuration_directory: “C:\Program Files\Graylog\sidecar\generated”
Range of windows drives which are checked for disk usage. If their usage extends 75% they will be reported
in the sidecar’s status report to the Graylog server. Set to “” to disable disk scanning.
Default:
windows_drive_range: “CDEFGHIJKLMNOPQRSTUVWXYZ”
A list of tags to assign to this sidecar. Collector configuration matching any of these tags will automatically be
applied to the sidecar.
Default:
tags: [ default ]
Example:
tags:
- apache-logs
- dns-logs
A list of binaries which are allowed to be executed by the Sidecar. An empty list disables the access list feature.
Wildcards can be used, for a full pattern description see filepath package - path/filepath - Go Packages
Example:
collector_binaries_accesslist:
- “C:\Program Files\Graylog\sidecar\winlogbeat.exe”
- “C:\Program Files\Filebeat\filebeat.exe”
Example disable access listing:
collector_binaries_accesslist:
Default:
collector_binaries_accesslist:
- “C:\Program Files\Graylog\sidecar\filebeat.exe”
- “C:\Program Files\Graylog\sidecar\winlogbeat.exe”
- “C:\Program Files\Filebeat\filebeat.exe”
- “C:\Program Files\Packetbeat\packetbeat.exe”
- “C:\Program Files\Metricbeat\metricbeat.exe”
- “C:\Program Files\Heartbeat\heartbeat.exe”
- “C:\Program Files\Auditbeat\auditbeat.exe”
- “C:\Program Files (x86)\nxlog\nxlog.exe”
- “C:\Program Files\nxlog\nxlog.exe”
(sidecar.log)
time=“2024-04-22T11:24:00-07:00” level=info msg=“Starting signal distributor”
time=“2024-04-22T11:24:00-07:00” level=info msg=“Adding process runner for: winlogbeat-6622d69439fc515d2219e98d”
time=“2024-04-22T11:24:00-07:00” level=info msg=“[winlogbeat-6622d69439fc515d2219e98d] Configuration change detected, rewriting configuration file.”
time=“2024-04-22T11:24:00-07:00” level=info msg=“Trying to create directory for: C:\Program Files\Graylog\sidecar\generated\6622d69439fc515d2219e98d\winlogbeat.conf”
time=“2024-04-22T11:24:02-07:00” level=info msg=“[winlogbeat-6622d69439fc515d2219e98d] Starting (svc driver)”
time=“2024-04-22T11:58:20-07:00” level=info msg=“[winlogbeat-6622d69439fc515d2219e98d] Configuration change detected, rewriting configuration file.”
time=“2024-04-22T11:58:22-07:00” level=info msg=“[winlogbeat-6622d69439fc515d2219e98d] Stopping”
time=“2024-04-22T11:58:24-07:00” level=info msg=“[winlogbeat-6622d69439fc515d2219e98d] Starting (svc driver)”
(Beats input config)
bind_address: 0.0.0.0
charset_name: UTF-8
no_beats_prefix: false
number_worker_threads: 6
override_source:
port: 5044
recv_buffer_size: 1048576
tcp_keepalive: false
tls_cert_file:
tls_client_auth: disabled
tls_client_auth_cert_file:
tls_enable: false
tls_key_file:
tls_key_password:********
(TCPDUMP)
3. What steps have you already taken to try and solve the problem?
I’ve tried looking through the posts and found a lot of really good info but nothing that seemed to stick. I’ve tried following this post and adding event.id to the winlogbeat config.
Ingest Windows Event Logs…
Universal-Winlogbeat-configuration/assets/winlogbeat.yml at main · jhochwald/Universal-Winlogbeat-configuration · GitHub
Still no go. Even though I have this feeling this might still be the issue.
NXLog is working. The sidecar is connecting to the server as I can modify the config in the console and the machines pickup the changes right away
4. How can the community help?
I have a feeling it is something simple I’m missing in a config file I’m just not seeing it yet. Any help would be appreciated.
