"Unknown beats protocol version: 3" using winlogbeat v5.1.1

Graylog Central (peer support)
,
13

ok, let me review things here. Winlogbeat.log shows nothing. Hasn’t even been created.
I’m testing Graylog server on a VM IP 172.97.28.4 and Sidecar on two different machines: a windows VM running at 10.2.11.142 and a notebook that when I at cable on work runs at 10.2.16.60, but also connects at work via Wi-Fi and from home via VPN.

Both sidecars get this initial error messages:

time="2017-06-08T12:30:36-03:00" level=debug msg="[signal-processor] (seq=1) handling cmd: restart" 
time="2017-06-08T12:30:36-03:00" level=info msg="[winlogbeat] Starting (exec driver)" 
time="2017-06-08T12:30:36-03:00" level=debug msg="Creating rotated log writer for: C:\\Program Files\\graylog\\collector-sidecar\\logs\\winlogbeat_stderr.log.%Y%m%d%H%M" 
time="2017-06-08T12:30:36-03:00" level=debug msg="Creating rotated log writer for: C:\\Program Files\\graylog\\collector-sidecar\\logs\\winlogbeat_stderr.log.%Y%m%d%H%M" 
time="2017-06-08T12:30:36-03:00" level=debug msg="[signal-processor] (seq=1) cmd done: restart" 
time="2017-06-08T12:30:37-03:00" level=error msg="[winlogbeat] Backend finished unexpectedly, trying to restart 1/3." 
time="2017-06-08T12:30:37-03:00" level=debug msg="[signal-processor] (seq=2) handling cmd: restart" 
time="2017-06-08T12:30:37-03:00" level=info msg="[winlogbeat] Stopping" 
time="2017-06-08T12:30:39-03:00" level=debug msg="[winlogbeat] SIGHUP ignored, killing process" 
time="2017-06-08T12:30:39-03:00" level=debug msg="[winlogbeat] Failed to kill process invalid argument" 
time="2017-06-08T12:30:39-03:00" level=info msg="[winlogbeat] Starting (exec driver)" 
time="2017-06-08T12:30:39-03:00" level=debug msg="Creating rotated log writer for: C:\\Program Files\\graylog\\collector-sidecar\\logs\\winlogbeat_stderr.log.%Y%m%d%H%M" 
time="2017-06-08T12:30:39-03:00" level=debug msg="Creating rotated log writer for: C:\\Program Files\\graylog\\collector-sidecar\\logs\\winlogbeat_stderr.log.%Y%m%d%H%M" 
time="2017-06-08T12:30:39-03:00" level=debug msg="[signal-processor] (seq=2) cmd done: restart" 
time="2017-06-08T12:30:40-03:00" level=error msg="[winlogbeat] Backend finished unexpectedly, trying to restart 2/3." 
time="2017-06-08T12:30:40-03:00" level=debug msg="[signal-processor] (seq=3) handling cmd: restart" 
time="2017-06-08T12:30:40-03:00" level=info msg="[winlogbeat] Stopping" 
time="2017-06-08T12:30:42-03:00" level=debug msg="[winlogbeat] SIGHUP ignored, killing process" 
time="2017-06-08T12:30:42-03:00" level=debug msg="[winlogbeat] Failed to kill process invalid argument" 
time="2017-06-08T12:30:42-03:00" level=info msg="[winlogbeat] Starting (exec driver)" 
time="2017-06-08T12:30:42-03:00" level=debug msg="Creating rotated log writer for: C:\\Program Files\\graylog\\collector-sidecar\\logs\\winlogbeat_stderr.log.%Y%m%d%H%M" 
time="2017-06-08T12:30:42-03:00" level=debug msg="Creating rotated log writer for: C:\\Program Files\\graylog\\collector-sidecar\\logs\\winlogbeat_stderr.log.%Y%m%d%H%M" 
time="2017-06-08T12:30:42-03:00" level=debug msg="[signal-processor] (seq=3) cmd done: restart" 
time="2017-06-08T12:30:43-03:00" level=error msg="[winlogbeat] Backend finished unexpectedly, trying to restart 3/3." 
time="2017-06-08T12:30:43-03:00" level=debug msg="[signal-processor] (seq=4) handling cmd: restart" 
time="2017-06-08T12:30:43-03:00" level=info msg="[winlogbeat] Stopping" 
time="2017-06-08T12:30:45-03:00" level=debug msg="[winlogbeat] SIGHUP ignored, killing process" 
time="2017-06-08T12:30:45-03:00" level=debug msg="[winlogbeat] Failed to kill process invalid argument" 
time="2017-06-08T12:30:45-03:00" level=info msg="[winlogbeat] Starting (exec driver)" 
time="2017-06-08T12:30:45-03:00" level=debug msg="Creating rotated log writer for: C:\\Program Files\\graylog\\collector-sidecar\\logs\\winlogbeat_stderr.log.%Y%m%d%H%M" 
time="2017-06-08T12:30:45-03:00" level=debug msg="Creating rotated log writer for: C:\\Program Files\\graylog\\collector-sidecar\\logs\\winlogbeat_stderr.log.%Y%m%d%H%M" 
time="2017-06-08T12:30:45-03:00" level=debug msg="[signal-processor] (seq=4) cmd done: restart" 
time="2017-06-08T12:30:46-03:00" level=error msg="[winlogbeat] Unable to start collector after 3 tries, giving up!"

After the “giving up!” message, the Windows VM starts sending logs to Graylog, so we can see it showing up on Sources quick values graph:

image.png1229×691 151 KB

This is where the scenario problems connects with my other post on the forum:

https://community.graylog.org/t/ova-not-listening-refusing-connection-on-443/

I was having this connection refusal problem on both machines. Followed documentation and created a self-signed certificate. Now, Windows VM is able to send logs (where before it couldn’t), but the Windows notebook is receiving a new error message:

time="2017-06-10T12:52:55-03:00" level=error msg="[RequestConfiguration] Fetching configuration failed: Get https://172.28.97.4:443/api/plugins/org.graylog.plugins.collector/281fbe5f-9222-4877-9b9d-00240350bc91?tags=%5B%22windows%22%2C%22desktop%22%5D: x509: certificate signed by unknown authority" 
time="2017-06-10T12:52:57-03:00" level=error msg="[UpdateRegistration] Failed to report collector status to server: Put https://172.28.97.4:443/api/plugins/org.graylog.plugins.collector/collectors/281fbe5f-9222-4877-9b9d-00240350bc91: x509: certificate signed by unknown authority"

But both cases start with that same “error package”, saying the backend finished unexpectedly - even though the VM sidecar and winlogbeat backend are working.