On our Endpoint Log Hybrid (Not a legacy collector), I'm seeing the following errors in the /var/log/messages file for all of our Windows Event Sources.
Dec 18 02:36:46 <END_LOG_HYBRID> NwLogCollector: [WindowsCollection] [warning] [<AD_DOMAIN_CONTROLLER>] [processing] [WorkUnit] [processing] Log for channel Security may have rolled over. Previous/Current record number: 775648485/775648488.
I've followed the suggestions in this document 000029686 - Windows legacy log collection warning message "System may have rolled over" in RSA Netwitness but it doesn't seem to make a difference.
Our current event log settings on the Domain Controller.
Settings within the Log Collector configuration
Could I see a pic of the domain config page? Are you excluding security 4661? This was an issue before in Windows, that caused this exact message.
You might want to check the log collector logs and check if you are getting ‘resubscribing’. Messages
Either way filter the 4661 message in the domain config section
Thanks, I posted this earlier. I thought this was what you were after, but wanted to check you were talking about the same place.
With filtering event 4661, there aren't any incidents where that would be useful?
Also I 'think' I may have found what could be causing the issue. We have had a number of DCs refreshed, and the new ones are reusing IP addresses of the old DCs, so that could be what's causing a conflict
I have now. It appears to be have resolved the issue. I haven't seen the rolling log error for about 15 minutes now.
Wouldn't event 4661 be required in an incident response scenario? Do I have to keep this filtering enabled or can it be removed after a period of time.
Why is this filtering required now, it hasn't been a problem for us in the past, it's only received become an issue?
I have not found a use for that event yet..
And that filter is permanent. It is a Microsoft bug that we have been working with them on.
Basically the message is corrupt and corrupts the whole log package. Once that happens a new subscription is started. The time stamps are different than the previous subscription.
This is the error you are seeing
Here is more about the 4661 message
Ok, good to know. thanks for your help in getting this resolved.
I'm guessing this isn't an issue when using NetWitness Endpoint for forwarding logs?