# Winlogbeat Input issue **URL:** \ **Category:** Graylog Central (peer support)\ **Tags:** sidecar, winlogbeat\ **Created:** [August 9, 2022, 9:38am UTC](https://community.graylog.org/t/winlogbeat-input-issue/25201 "2022-08-09T09:38:51Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![simonechg](https://avatars.discourse-cdn.com/v4/letter/s/b4bc9f/32.png) [@simonechg](https://community.graylog.org/u/simonechg)\ **Post date:** [August 9, 2022, 9:38am UTC](https://community.graylog.org/t/winlogbeat-input-issue/25201/1 "2022-08-09T09:38:51Z")
Hi everyone , I’m new to Graylog and I have some difficulties with Winlogbeats. I can’t see all Winlogbeat in the sidecar list page. I have deployed sidecar on approximately 60 windows box. In the sidecar/administration page i see only 25. In the input page there is always max 25 active connection. ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/1/18f6d3d47e8bb08532472e2824f07dd8f1fac6a5.png) I have already reboot the server and reinstall some winlogbeat. How can I resolve my issue ? Do I need an enterprise license to add more than 25 input connections ? Regards **2. Describe your environment:** - OS Information: Ubuntu 20.04 - Package Version: 4.3.4 open suorce ---
**Author:** ![tmacgbay](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/tmacgbay/32/3878_2.png) [@tmacgbay](https://community.graylog.org/u/tmacgbay)\ **Post date:** [August 9, 2022, 4:51pm UTC](https://community.graylog.org/t/winlogbeat-input-issue/25201/2 "2022-08-09T16:51:40Z")
> [@simonechg](#): > > Do I need an enterprise license to add more than 25 input connections ? No, this area is unlimited. Check the System/Sidecar/overview page to see if the sidecars are running and configurations are applied to all of them. On the windows machines that are not reporting there are log files you can examine (default location is: C:\Program Files\Graylog\sidecar\logs) You can post up log snippets (using the `` forum tool to make code/logs pretty and obfuscating where needed) if you have further questions… ---
**Author:** ![simonechg](https://avatars.discourse-cdn.com/v4/letter/s/b4bc9f/32.png) [@simonechg](https://community.graylog.org/u/simonechg)\ **Post date:** [August 10, 2022, 6:48am UTC](https://community.graylog.org/t/winlogbeat-input-issue/25201/3 "2022-08-10T06:48:08Z")
Hi tmacgbay I will check log file and then I post up if I need. Many thanks. ---
**Author:** ![simonechg](https://avatars.discourse-cdn.com/v4/letter/s/b4bc9f/32.png) [@simonechg](https://community.graylog.org/u/simonechg)\ **Post date:** [August 11, 2022, 2:56pm UTC](https://community.graylog.org/t/winlogbeat-input-issue/25201/4 "2022-08-11T14:56:07Z")
here some log from windows machine that are not reporting ```auto time="2022-08-04T11:56:45+02:00" level=info msg="Starting signal distributor" time="2022-08-04T11:57:16+02:00" level=error msg="[UpdateRegistration] Failed to report collector status to server: Put \"http://x.x.x.x:9000/api%20/sidecars/xxxx\": dial tcp x.x.x.x:9000: connectex: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond." time="2022-08-04T12:47:14+02:00" level=error msg="[UpdateRegistration] Bad response from Graylog server: 404 Not Found" time="2022-08-04T16:43:56+02:00" level=error msg="[UpdateRegistration] Failed to report collector status to server: Put \"http://x.x.x.x:9000/api%20/sidecars/2c5b7b80-53f8-44f0-b5ba-feace31c8199\": EOF" time="2022-08-04T16:44:08+02:00" level=error msg="[UpdateRegistration] Failed to report collector status to server: Put \"http://x.x.x.x:9000/api%20/sidecars/2c5b7b80-53f8-44f0-b5ba-feace31c8199\": dial tcp x.x.x.x:9000: connectex: No connection could be made because the target machine actively refused it." time="2022-08-04T17:48:49+02:00" level=error msg="[UpdateRegistration] Failed to report collector status to server: Put \"http://x.x.x.x:9000/api%20/sidecars/2c5b7b80-53f8-44f0-b5ba-feace31c8199\": read tcp x.x.x.x:59029->172.17.4.24:9000: wsarecv: An existing connection was forcibly closed by the remote host." ``` ---
**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\ **Post date:** [August 11, 2022, 9:58pm UTC](https://community.graylog.org/t/winlogbeat-input-issue/25201/5 "2022-08-11T21:58:10Z")
Hello, I noticed this… Sidecar is calling to Graylog using TCP . ```auto dial tcp x.x.x.x:9000 ``` And ```auto A connection attempt failed because the connected party did not properly respond after a period of time,or established connection failed because connected host has failed to respond." connection could be made because the target machine actively refused it." ``` You could try this if your TCP connection is not configured correctly. ```auto # This configures if the sidecar should skip the verification of TLS connections. # Default: false tls_skip_verify: true ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [August 25, 2022, 9:58pm UTC](https://community.graylog.org/t/winlogbeat-input-issue/25201/6 "2022-08-25T21:58:52Z")
Closed on August 25, 2022, 9:58pm UTC This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.