000038047 - Windows logs are not coming to RSA NetWitness Platform due to "bookmark as 1" errors

Sep 16 09:32:58 VLC NwLogCollector[15403]: [WindowsCollection] [failure] [windowshost] Bookmarks received: Application=204,Security=1,System=108
Sep 16 09:32:58 VLC NwLogCollector[15403]: [WindowsCollection] [failure] [windowshost] [processing] [WorkUnit] [processing] Remote event source [windowshost] has returned bookmark as '1' for one or more channels which maye be an error.Discarding pulled events and reverting bookmarks for all channels to previous known bookmarks.

1. Login to the Windows server. Run the below commands as Administrator from the command prompt.
   

   
   winrm quickconfig
   wevtutil gl security > securityevtorig.txt

   
   
2. Open securityevtorig.txt file.
        Example Output:
   

   
   name: security
   enabled: true
   type: Admin
   owningPublisher:
   isolation: security
   channelAccess: O:BAG:SYD:(A;;0xf0007;;;SY)(A;;0x7;;;BA)(A;;0x3;;;BO)(A;;0x5;;;SO)(A;;0x1;;;IU)(A;;0x3;;;SU)(A;;0x1;;;S-1-5-3)(A;;0x2;;;S-1-5-33)
   logging:
     logFileName: %SystemRoot%\System32\Winevt\Logs\security.evtx
     retention: false
     autoBackup: false
     maxSize: 16777216
   publishing:
     fileMax: 1

   
   
3. Copy the channel access value and replace existing-SDDL-string to grant read access to the Event Log Readers group.
   

   
   wevtutil sl security /ca:existing-SDDL-string(A;;0x1;;;S-1-5-32-573)

   
         Example:
   
   

   
   wevtutil sl security /ca:O:BAG:SYD:(A;;0xf0007;;;SY)(A;;0x7;;;BA)(A;;0x3;;;BO)(A;;0x5;;;SO)(A;;0x1;;;IU)(A;;0x3;;;SU)(A;;0x1;;;S-1-5-3)(A;;0x2;;;S-1-5-33)(A;;0x1;;;S-1-5-32-573)

   
   
4. Repeat the same process to grant read access to the Network Service account.
   

   
   wevtutil sl security /ca:existing-SDDL-string(A;;0x1;;;s-1-5-20)

   
         Example:
   
   

   
   wevtutil sl security /ca:O:BAG:SYD:(A;;0xf0007;;;SY)(A;;0x7;;;BA)(A;;0x3;;;BO)(A;;0x5;;;SO)(A;;0x1;;;IU)(A;;0x3;;;SU)(A;;0x1;;;S-1-5-3)(A;;0x2;;;S-1-5-33)(A;;0x1;;;s-1-5-20)

   
   
5. After the above steps, login to NetWitness GUI and restart the Windows collection in the Log Collector's System page.
6. Verify that the bookmark errors are no longer being seen under /var/log/messages and logs are visible in the Investigation page.