Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[winlogbeat] Windows event log XMLs are truncated if exceed 8KB #41245

Closed
intxgo opened this issue Oct 15, 2024 · 1 comment
Closed

[winlogbeat] Windows event log XMLs are truncated if exceed 8KB #41245

intxgo opened this issue Oct 15, 2024 · 1 comment
Labels
bug needs_team Indicates that the issue/PR needs a Team:* label Winlogbeat

Comments

@intxgo
Copy link
Contributor

intxgo commented Oct 15, 2024

Winlogbeat is truncating Windows event log XMLs above 8KB. The event document contains RenderErr:[XML syntax error on line xxx: unexpected EOF] in message node.

The above error is caused by truncated XML. Winlogbeat is using EvtRender API with pre-allocated buffer for efficiency. Unfortunately this API can succeed returning truncated data in provided buffer.

For confirmed bugs, please report:

  • Version: 8.15
@botelastic botelastic bot added the needs_team Indicates that the issue/PR needs a Team:* label label Oct 15, 2024
@botelastic
Copy link

botelastic bot commented Oct 15, 2024

This issue doesn't have a Team:<team> label.

@intxgo intxgo mentioned this issue Oct 18, 2024
Merged
6 tasks
This was referenced Oct 22, 2024
Merged
Merged
Merged
@intxgo intxgo closed this as completed Nov 21, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug needs_team Indicates that the issue/PR needs a Team:* label Winlogbeat
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@intxgo