Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

x-pack/winlogbeat: windows-11TestSecurity/4707_WindowsSrv2016.evtx – github.com/elastic/beats/v7/x-pack/winlogbeat/module/security/test #32469

Closed
v1v opened this issue Jul 22, 2022 · 4 comments · Fixed by #32519
Labels
flaky-test Unstable or unreliable test cases.

Comments

@v1v
Copy link
Member

v1v commented Jul 22, 2022

Flaky Test

  • Test Name: TestSecurity/4707_WindowsSrv2016.evtx – github.com/elastic/beats/v7/x-pack/winlogbeat/module/security/test
  • Link: Link to file/line number in github.
  • Branch: ci: add extended support for windows-11 #32236
  • Artifact Link: If available, attach the generated zip artifact associated with the stack trace for this failure.
  • Notes: Additional details about the test. e.g. theory as to failure cause

image

Stack Trace

 === RUN   TestSecurity/4707_WindowsSrv2016.evtx

Build logs

[2022-07-07T13:41:21.369Z] 
[2022-07-07T13:41:21.369Z] C:\Users\jenkins\workspace\PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea\src\github.com\elastic\beats\x-pack\winlogbeat>mage build unitTest 
[2022-07-07T13:41:39.472Z] >> build: Building winlogbeat
[2022-07-07T13:43:07.831Z] No fields files for module routing
[2022-07-07T13:43:07.831Z] No fields files for module wintest
[2022-07-07T13:43:07.831Z] Generated fields.yml for winlogbeat to C:\Users\jenkins\workspace\PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea\src\github.com\elastic\beats\x-pack\winlogbeat\build\fields\fields.all.yml
[2022-07-07T13:43:07.831Z] Generated fields.yml for winlogbeat to C:\Users\jenkins\workspace\PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea\src\github.com\elastic\beats\x-pack\winlogbeat\build\fields\fields.yml
[2022-07-07T13:43:11.131Z] >> go test: Unit Testing
[2022-07-07T13:43:11.131Z] exec: gotestsum --no-color -f standard-quiet --junitfile build/TEST-go-unit.xml --jsonfile build/TEST-go-unit.out.json -- -tags null oracle -covermode=atomic -coverprofile=build\TEST-go-unit.cov -p 1 ./...
[2022-07-07T13:46:48.599Z] ok  	github.com/elastic/beats/v7/x-pack/winlogbeat	0.309s	coverage: 0.0% of statements
[2022-07-07T13:46:48.599Z] ?   	github.com/elastic/beats/v7/x-pack/winlogbeat/cmd	[no test files]
[2022-07-07T13:46:48.599Z] ?   	github.com/elastic/beats/v7/x-pack/winlogbeat/include	[no test files]
[2022-07-07T13:46:48.599Z] ?   	github.com/elastic/beats/v7/x-pack/winlogbeat/module	[no test files]
[2022-07-07T13:46:48.599Z] ?   	github.com/elastic/beats/v7/x-pack/winlogbeat/module/powershell	[no test files]
[2022-07-07T13:46:48.599Z] coverage: [no statements]
[2022-07-07T13:46:48.599Z] ok  	github.com/elastic/beats/v7/x-pack/winlogbeat/module/powershell/test	1.318s	coverage: [no statements]
[2022-07-07T13:46:48.599Z] ?   	github.com/elastic/beats/v7/x-pack/winlogbeat/module/security	[no test files]
[2022-07-07T13:46:49.546Z] FAIL	github.com/elastic/beats/v7/x-pack/winlogbeat/module/security/test	1.553s
[2022-07-07T13:46:49.546Z] ?   	github.com/elastic/beats/v7/x-pack/winlogbeat/module/sysmon	[no test files]
[2022-07-07T13:46:53.742Z] coverage: [no statements]
[2022-07-07T13:46:53.742Z] ok  	github.com/elastic/beats/v7/x-pack/winlogbeat/module/sysmon/test	0.602s	coverage: [no statements]
[2022-07-07T13:46:53.742Z] ?   	github.com/elastic/beats/v7/x-pack/winlogbeat/module/wintest	[no test files]
[2022-07-07T13:46:54.690Z] 
[2022-07-07T13:46:54.690Z] === Failed
[2022-07-07T13:46:54.690Z] === FAIL: x-pack/winlogbeat/module/security/test TestSecurity/1102.evtx (unknown)
[2022-07-07T13:46:54.690Z] 
[2022-07-07T13:46:54.690Z] === FAIL: x-pack/winlogbeat/module/security/test TestSecurity/1104.evtx (unknown)
[2022-07-07T13:46:54.690Z] 
[2022-07-07T13:46:54.690Z] === FAIL: x-pack/winlogbeat/module/security/test TestSecurity/1105.evtx (unknown)
[2022-07-07T13:46:54.690Z] 
[2022-07-07T13:46:54.690Z] === FAIL: x-pack/winlogbeat/module/security/test TestSecurity/4670_WindowsSrv2016.evtx (unknown)
[2022-07-07T13:46:54.690Z] 
[2022-07-07T13:46:54.690Z] === FAIL: x-pack/winlogbeat/module/security/test TestSecurity/4706_WindowsSrv2016.evtx (unknown)
[2022-07-07T13:46:54.690Z] 
[2022-07-07T13:46:54.690Z] === FAIL: x-pack/winlogbeat/module/security/test TestSecurity/4707_WindowsSrv2016.evtx (unknown)
[2022-07-07T13:46:54.690Z] Exception 0xc0000005 0x1 0xc000eb43d6 0x7ff835e0d2e6
[2022-07-07T13:46:54.690Z] PC=0x7ff835e0d2e6
[2022-07-07T13:46:54.690Z] 
[2022-07-07T13:46:54.690Z] runtime.cgocall(0xd4ce40, 0xc000089ee0)
[2022-07-07T13:46:54.690Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/.gvm/versions/go1.17.11.windows.amd64/src/runtime/cgocall.go:156 +0x4a fp=0xc000a92480 sp=0xc000a92448 pc=0xce45ea
[2022-07-07T13:46:54.690Z] syscall.Syscall9(0x7ff835e0cb10, 0x9, 0xb, 0x0, 0xb0001424, 0x63, 0xc00013e948, 0x8, 0x46c, 0xc000eb3b00, ...)
[2022-07-07T13:46:54.690Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/.gvm/versions/go1.17.11.windows.amd64/src/runtime/syscall_windows.go:510 +0xdb fp=0xc000a924a8 sp=0xc000a92480 pc=0xd47c9b
[2022-07-07T13:46:54.690Z] syscall.Syscall9(0x101000000000007, 0x24ce4b8ddd8, 0x0, 0x46c, 0x24cdef60eb8, 0x480, 0xc000089c00, 0xc000eb3b00, 0x0, 0xc000eb3b00, ...)
[2022-07-07T13:46:54.690Z] 	<autogenerated>:1 +0x59 fp=0xc000a92528 sp=0xc000a924a8 pc=0xd4de39
[2022-07-07T13:46:54.690Z] github.com/elastic/beats/v7/winlogbeat/sys/wineventlog._EvtFormatMessage(0xc000a925e8, 0xd, 0xb0001424, 0x63, 0xc000a92624, 0x8, 0x46c, 0xc000eb3b00, 0xc000a92600)
[2022-07-07T13:46:54.690Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/src/github.com/elastic/beats/winlogbeat/sys/wineventlog/zsyscall_windows.go:132 +0x105 fp=0xc000a925c0 sp=0xc000a92528 pc=0x15a2c45
[2022-07-07T13:46:54.690Z] github.com/elastic/beats/v7/winlogbeat/sys/wineventlog.evtFormatMessage(0xc000602d00, 0xc00030f6b7, 0x25375a0, {0xc00013e948, 0x63, 0xc000a92750}, 0x1596705)
[2022-07-07T13:46:54.690Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/src/github.com/elastic/beats/winlogbeat/sys/wineventlog/format_message.go:92 +0x1b6 fp=0xc000a92690 sp=0xc000a925c0 pc=0x1593956
[2022-07-07T13:46:54.690Z] github.com/elastic/beats/v7/winlogbeat/sys/wineventlog.getMessageString(0x400, 0x25375a0, 0x399dd0, {0xc00013e948, 0xb, 0x38d})
[2022-07-07T13:46:54.690Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/src/github.com/elastic/beats/winlogbeat/sys/wineventlog/format_message.go:58 +0x45 fp=0xc000a926d8 sp=0xc000a92690 pc=0x15936e5
[2022-07-07T13:46:54.690Z] github.com/elastic/beats/v7/winlogbeat/sys/wineventlog.(*EventMetadata).initEventMessage(0xc00063e1c0, 0xd, 0x0)
[2022-07-07T13:46:54.690Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/src/github.com/elastic/beats/winlogbeat/sys/wineventlog/metadata_store.go:405 +0x73 fp=0xc000a92760 sp=0xc000a926d8 pc=0x15967d3
[2022-07-07T13:46:54.690Z] github.com/elastic/beats/v7/winlogbeat/sys/wineventlog.newEventMetadataFromPublisherMetadata(0xc000642450, 0xc000642480)
[2022-07-07T13:46:54.690Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/src/github.com/elastic/beats/winlogbeat/sys/wineventlog/metadata_store.go:345 +0x9c fp=0xc000a92810 sp=0xc000a92760 pc=0x159639c
[2022-07-07T13:46:54.690Z] github.com/elastic/beats/v7/winlogbeat/sys/wineventlog.(*PublisherMetadataStore).initEvents(0xc00063cba0)
[2022-07-07T13:46:54.690Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/src/github.com/elastic/beats/winlogbeat/sys/wineventlog/metadata_store.go:181 +0x105 fp=0xc000a928d0 sp=0xc000a92810 pc=0x1595265
[2022-07-07T13:46:54.690Z] github.com/elastic/beats/v7/winlogbeat/sys/wineventlog.NewPublisherMetadataStore(0xc000642060, {0xc000e4b830, 0x23}, 0x23)
[2022-07-07T13:46:54.690Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/src/github.com/elastic/beats/winlogbeat/sys/wineventlog/metadata_store.go:81 +0x199 fp=0xc000a929c8 sp=0xc000a928d0 pc=0x15947d9
[2022-07-07T13:46:54.690Z] github.com/elastic/beats/v7/winlogbeat/eventlog.(*winMetaCache).winMeta(0xc000632640, {0xc000e4b830, 0x23})
[2022-07-07T13:46:54.690Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/src/github.com/elastic/beats/winlogbeat/eventlog/wineventlog.go:470 +0x1d6 fp=0xc000a92a88 sp=0xc000a929c8 pc=0x15ac576
[2022-07-07T13:46:54.690Z] github.com/elastic/beats/v7/winlogbeat/eventlog.(*winEventLog).buildRecordFromXML(_, {_, _, _}, {_, _})
[2022-07-07T13:46:54.690Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/src/github.com/elastic/beats/winlogbeat/eventlog/wineventlog.go:406 +0x493 fp=0xc000a932e0 sp=0xc000a92a88 pc=0x15ac093
[2022-07-07T13:46:54.690Z] github.com/elastic/beats/v7/winlogbeat/eventlog.(*winEventLog).Read(0xc0006324e0)
[2022-07-07T13:46:54.691Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/src/github.com/elastic/beats/winlogbeat/eventlog/wineventlog.go:323 +0x5c5 fp=0xc000a938e0 sp=0xc000a932e0 pc=0x15aaf85
[2022-07-07T13:46:54.691Z] github.com/elastic/beats/v7/x-pack/winlogbeat/module.testCollectionPipeline({0x2ccd190, 0xc0006321a0}, {0xc000392660, 0x2c}, 0xc0002ecdb0)
[2022-07-07T13:46:54.691Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/src/github.com/elastic/beats/x-pack/winlogbeat/module/testing_windows.go:83 +0x445 fp=0xc000a93f38 sp=0xc000a938e0 pc=0x15b1ce5
[2022-07-07T13:46:54.691Z] github.com/elastic/beats/v7/x-pack/winlogbeat/module.TestCollectionPipeline.func1(0x24cdef60eb8)
[2022-07-07T13:46:54.691Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/src/github.com/elastic/beats/x-pack/winlogbeat/module/testing_windows.go:52 +0x32 fp=0xc000a93f70 sp=0xc000a93f38 pc=0x15b1872
[2022-07-07T13:46:54.691Z] testing.tRunner(0xc0006321a0, 0xc000ccf4e8)
[2022-07-07T13:46:54.691Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/.gvm/versions/go1.17.11.windows.amd64/src/testing/testing.go:1259 +0x102 fp=0xc000a93fc0 sp=0xc000a93f70 pc=0xe09bc2
[2022-07-07T13:46:54.691Z] testing.(*T).Run·dwrap·21()
[2022-07-07T13:46:54.691Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/.gvm/versions/go1.17.11.windows.amd64/src/testing/testing.go:1306 +0x2a fp=0xc000a93fe0 sp=0xc000a93fc0 pc=0xe0a8ca
[2022-07-07T13:46:54.691Z] runtime.goexit()
[2022-07-07T13:46:54.691Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/.gvm/versions/go1.17.11.windows.amd64/src/runtime/asm_amd64.s:1581 +0x1 fp=0xc000a93fe8 sp=0xc000a93fe0 pc=0xd4b581
[2022-07-07T13:46:54.691Z] created by testing.(*T).Run
[2022-07-07T13:46:54.691Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/.gvm/versions/go1.17.11.windows.amd64/src/testing/testing.go:1306 +0x35a
[2022-07-07T13:46:54.691Z] 
[2022-07-07T13:46:54.691Z] goroutine 1 [chan receive]:
[2022-07-07T13:46:54.691Z] testing.(*T).Run(0xc0006049c0, {0x285a132, 0xd4e193}, 0x29dbdf8)
[2022-07-07T13:46:54.691Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/.gvm/versions/go1.17.11.windows.amd64/src/testing/testing.go:1307 +0x375
[2022-07-07T13:46:54.691Z] testing.runTests.func1(0xc000849410)
[2022-07-07T13:46:54.691Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/.gvm/versions/go1.17.11.windows.amd64/src/testing/testing.go:1598 +0x6e
[2022-07-07T13:46:54.691Z] testing.tRunner(0xc0006049c0, 0xc00081fce0)
[2022-07-07T13:46:54.691Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/.gvm/versions/go1.17.11.windows.amd64/src/testing/testing.go:1259 +0x102
[2022-07-07T13:46:54.691Z] testing.runTests(0xc0000c3c00, {0x3ec4360, 0x1, 0x1}, {0xd7b02d, 0x285e797, 0x3ef0060})
[2022-07-07T13:46:54.691Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/.gvm/versions/go1.17.11.windows.amd64/src/testing/testing.go:1596 +0x43f
[2022-07-07T13:46:54.691Z] testing.(*M).Run(0xc0000c3c00)
[2022-07-07T13:46:54.691Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/.gvm/versions/go1.17.11.windows.amd64/src/testing/testing.go:1504 +0x51d
[2022-07-07T13:46:54.691Z] main.main()
[2022-07-07T13:46:54.691Z] 	_testmain.go:85 +0x1f5
[2022-07-07T13:46:54.691Z] 
[2022-07-07T13:46:54.691Z] goroutine 21 [chan receive]:
[2022-07-07T13:46:54.691Z] github.com/klauspost/compress/zstd.(*blockDec).startDecoder(0xc0005236c0)
[2022-07-07T13:46:54.691Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/pkg/mod/github.com/klauspost/compress@v1.13.6/zstd/blockdec.go:212 +0x94
[2022-07-07T13:46:54.691Z] created by github.com/klauspost/compress/zstd.newBlockDec
[2022-07-07T13:46:54.691Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/pkg/mod/github.com/klauspost/compress@v1.13.6/zstd/blockdec.go:118 +0x167
[2022-07-07T13:46:54.691Z] 
[2022-07-07T13:46:54.691Z] goroutine 22 [chan receive]:
[2022-07-07T13:46:54.691Z] github.com/klauspost/compress/zstd.(*blockDec).startDecoder(0xc000523790)
[2022-07-07T13:46:54.691Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/pkg/mod/github.com/klauspost/compress@v1.13.6/zstd/blockdec.go:212 +0x94
[2022-07-07T13:46:54.691Z] created by github.com/klauspost/compress/zstd.newBlockDec
[2022-07-07T13:46:54.691Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/pkg/mod/github.com/klauspost/compress@v1.13.6/zstd/blockdec.go:118 +0x167
[2022-07-07T13:46:54.691Z] 
[2022-07-07T13:46:54.691Z] goroutine 23 [chan receive]:
[2022-07-07T13:46:54.691Z] github.com/klauspost/compress/zstd.(*blockDec).startDecoder(0xc000523860)
[2022-07-07T13:46:54.691Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/pkg/mod/github.com/klauspost/compress@v1.13.6/zstd/blockdec.go:212 +0x94
[2022-07-07T13:46:54.691Z] created by github.com/klauspost/compress/zstd.newBlockDec
[2022-07-07T13:46:54.691Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/pkg/mod/github.com/klauspost/compress@v1.13.6/zstd/blockdec.go:118 +0x167
[2022-07-07T13:46:54.691Z] 
[2022-07-07T13:46:54.691Z] goroutine 24 [chan receive]:
[2022-07-07T13:46:54.691Z] github.com/klauspost/compress/zstd.(*blockDec).startDecoder(0xc000523930)
[2022-07-07T13:46:54.691Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/pkg/mod/github.com/klauspost/compress@v1.13.6/zstd/blockdec.go:212 +0x94
[2022-07-07T13:46:54.691Z] created by github.com/klauspost/compress/zstd.newBlockDec
[2022-07-07T13:46:54.691Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/pkg/mod/github.com/klauspost/compress@v1.13.6/zstd/blockdec.go:118 +0x167
[2022-07-07T13:46:54.691Z] 
[2022-07-07T13:46:54.691Z] goroutine 25 [chan receive]:
[2022-07-07T13:46:54.691Z] github.com/klauspost/compress/zstd.(*blockDec).startDecoder(0xc000523a00)
[2022-07-07T13:46:54.691Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/pkg/mod/github.com/klauspost/compress@v1.13.6/zstd/blockdec.go:212 +0x94
[2022-07-07T13:46:54.691Z] created by github.com/klauspost/compress/zstd.newBlockDec
[2022-07-07T13:46:54.691Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/pkg/mod/github.com/klauspost/compress@v1.13.6/zstd/blockdec.go:118 +0x167
[2022-07-07T13:46:54.691Z] 
[2022-07-07T13:46:54.691Z] goroutine 26 [chan receive]:
[2022-07-07T13:46:54.691Z] github.com/klauspost/compress/zstd.(*blockDec).startDecoder(0xc000523ad0)
[2022-07-07T13:46:54.691Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/pkg/mod/github.com/klauspost/compress@v1.13.6/zstd/blockdec.go:212 +0x94
[2022-07-07T13:46:54.691Z] created by github.com/klauspost/compress/zstd.newBlockDec
[2022-07-07T13:46:54.691Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/pkg/mod/github.com/klauspost/compress@v1.13.6/zstd/blockdec.go:118 +0x167
[2022-07-07T13:46:54.691Z] 
[2022-07-07T13:46:54.691Z] goroutine 27 [chan receive]:
[2022-07-07T13:46:54.691Z] github.com/klauspost/compress/zstd.(*blockDec).startDecoder(0xc000523ba0)
[2022-07-07T13:46:54.691Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/pkg/mod/github.com/klauspost/compress@v1.13.6/zstd/blockdec.go:212 +0x94
[2022-07-07T13:46:54.691Z] created by github.com/klauspost/compress/zstd.newBlockDec
[2022-07-07T13:46:54.691Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/pkg/mod/github.com/klauspost/compress@v1.13.6/zstd/blockdec.go:118 +0x167
[2022-07-07T13:46:54.691Z] 
[2022-07-07T13:46:54.691Z] goroutine 28 [chan receive]:
[2022-07-07T13:46:54.691Z] github.com/klauspost/compress/zstd.(*blockDec).startDecoder(0xc000523c70)
[2022-07-07T13:46:54.691Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/pkg/mod/github.com/klauspost/compress@v1.13.6/zstd/blockdec.go:212 +0x94
[2022-07-07T13:46:54.691Z] created by github.com/klauspost/compress/zstd.newBlockDec
[2022-07-07T13:46:54.691Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/pkg/mod/github.com/klauspost/compress@v1.13.6/zstd/blockdec.go:118 +0x167
[2022-07-07T13:46:54.691Z] 
[2022-07-07T13:46:54.691Z] goroutine 11 [chan receive]:
[2022-07-07T13:46:54.691Z] k8s.io/klog/v2.(*loggingT).flushDaemon(0x0)
[2022-07-07T13:46:54.691Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/pkg/mod/k8s.io/klog/v2@v2.30.0/klog.go:1181 +0x6a
[2022-07-07T13:46:54.691Z] created by k8s.io/klog/v2.init.0
[2022-07-07T13:46:54.692Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/pkg/mod/k8s.io/klog/v2@v2.30.0/klog.go:420 +0xfb
[2022-07-07T13:46:54.692Z] 
[2022-07-07T13:46:54.692Z] goroutine 29 [chan receive]:
[2022-07-07T13:46:54.692Z] testing.(*T).Run(0xc000604b60, {0xc000392674, 0x87}, 0xc000ccf4e8)
[2022-07-07T13:46:54.692Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/.gvm/versions/go1.17.11.windows.amd64/src/testing/testing.go:1307 +0x375
[2022-07-07T13:46:54.692Z] github.com/elastic/beats/v7/x-pack/winlogbeat/module.TestCollectionPipeline(0xc000604b60, {0x2874dc9, 0x1a}, {0xc0000a1f38, 0x1, 0xd4e193})
[2022-07-07T13:46:54.692Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/src/github.com/elastic/beats/x-pack/winlogbeat/module/testing_windows.go:51 +0x372
[2022-07-07T13:46:54.692Z] github.com/elastic/beats/v7/x-pack/winlogbeat/module/security/test.TestSecurity(0x0)
[2022-07-07T13:46:54.692Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/src/github.com/elastic/beats/x-pack/winlogbeat/module/security/test/security_windows_test.go:24 +0x85
[2022-07-07T13:46:54.692Z] testing.tRunner(0xc000604b60, 0x29dbdf8)
[2022-07-07T13:46:54.692Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/.gvm/versions/go1.17.11.windows.amd64/src/testing/testing.go:1259 +0x102
[2022-07-07T13:46:54.692Z] created by testing.(*T).Run
[2022-07-07T13:46:54.692Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/.gvm/versions/go1.17.11.windows.amd64/src/testing/testing.go:1306 +0x35a
[2022-07-07T13:46:54.692Z] 
[2022-07-07T13:46:54.692Z] goroutine 66 [select]:
[2022-07-07T13:46:54.692Z] github.com/elastic/beats/v7/libbeat/common.(*Cache).StartJanitor.func1()
[2022-07-07T13:46:54.692Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/src/github.com/elastic/beats/libbeat/common/cache.go:245 +0x85
[2022-07-07T13:46:54.692Z] created by github.com/elastic/beats/v7/libbeat/common.(*Cache).StartJanitor
[2022-07-07T13:46:54.692Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/src/github.com/elastic/beats/libbeat/common/cache.go:243 +0xb2
[2022-07-07T13:46:54.692Z] 
[2022-07-07T13:46:54.692Z] goroutine 90 [select]:
[2022-07-07T13:46:54.692Z] github.com/elastic/beats/v7/libbeat/common.(*Cache).StartJanitor.func1()
[2022-07-07T13:46:54.692Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/src/github.com/elastic/beats/libbeat/common/cache.go:245 +0x85
[2022-07-07T13:46:54.692Z] created by github.com/elastic/beats/v7/libbeat/common.(*Cache).StartJanitor
[2022-07-07T13:46:54.692Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/src/github.com/elastic/beats/libbeat/common/cache.go:243 +0xb2
[2022-07-07T13:46:54.692Z] 
[2022-07-07T13:46:54.692Z] goroutine 213 [select]:
[2022-07-07T13:46:54.692Z] github.com/elastic/beats/v7/libbeat/common.(*Cache).StartJanitor.func1()
[2022-07-07T13:46:54.692Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/src/github.com/elastic/beats/libbeat/common/cache.go:245 +0x85
[2022-07-07T13:46:54.692Z] created by github.com/elastic/beats/v7/libbeat/common.(*Cache).StartJanitor
[2022-07-07T13:46:54.692Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/src/github.com/elastic/beats/libbeat/common/cache.go:243 +0xb2
[2022-07-07T13:46:54.692Z] 
[2022-07-07T13:46:54.692Z] goroutine 165 [select]:
[2022-07-07T13:46:54.692Z] github.com/elastic/beats/v7/libbeat/common.(*Cache).StartJanitor.func1()
[2022-07-07T13:46:54.692Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/src/github.com/elastic/beats/libbeat/common/cache.go:245 +0x85
[2022-07-07T13:46:54.692Z] created by github.com/elastic/beats/v7/libbeat/common.(*Cache).StartJanitor
[2022-07-07T13:46:54.692Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/src/github.com/elastic/beats/libbeat/common/cache.go:243 +0xb2
[2022-07-07T13:46:54.692Z] 
[2022-07-07T13:46:54.692Z] goroutine 264 [select]:
[2022-07-07T13:46:54.692Z] github.com/elastic/beats/v7/libbeat/common.(*Cache).StartJanitor.func1()
[2022-07-07T13:46:54.692Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/src/github.com/elastic/beats/libbeat/common/cache.go:245 +0x85
[2022-07-07T13:46:54.692Z] created by github.com/elastic/beats/v7/libbeat/common.(*Cache).StartJanitor
[2022-07-07T13:46:54.692Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/src/github.com/elastic/beats/libbeat/common/cache.go:243 +0xb2
[2022-07-07T13:46:54.692Z] 
[2022-07-07T13:46:54.692Z] goroutine 704 [select]:
[2022-07-07T13:46:54.692Z] github.com/elastic/beats/v7/libbeat/common.(*Cache).StartJanitor.func1()
[2022-07-07T13:46:54.692Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/src/github.com/elastic/beats/libbeat/common/cache.go:245 +0x85
[2022-07-07T13:46:54.692Z] created by github.com/elastic/beats/v7/libbeat/common.(*Cache).StartJanitor
[2022-07-07T13:46:54.692Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/src/github.com/elastic/beats/libbeat/common/cache.go:243 +0xb2
[2022-07-07T13:46:54.692Z] 
[2022-07-07T13:46:54.692Z] goroutine 1184 [select]:
[2022-07-07T13:46:54.692Z] github.com/elastic/beats/v7/libbeat/common.(*Cache).StartJanitor.func1()
[2022-07-07T13:46:54.692Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/src/github.com/elastic/beats/libbeat/common/cache.go:245 +0x85
[2022-07-07T13:46:54.692Z] created by github.com/elastic/beats/v7/libbeat/common.(*Cache).StartJanitor
[2022-07-07T13:46:54.692Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/src/github.com/elastic/beats/libbeat/common/cache.go:243 +0xb2
[2022-07-07T13:46:54.692Z] rax     0x46b
[2022-07-07T13:46:54.692Z] rbx     0x0
[2022-07-07T13:46:54.692Z] rcx     0x0
[2022-07-07T13:46:54.692Z] rdi     0x46c
[2022-07-07T13:46:54.692Z] rsi     0x24cdee17790
[2022-07-07T13:46:54.692Z] rbp     0x865c7ff8e0
[2022-07-07T13:46:54.692Z] rsp     0x865c7ff7e0
[2022-07-07T13:46:54.692Z] r8      0x46c
[2022-07-07T13:46:54.692Z] r9      0x3e
[2022-07-07T13:46:54.692Z] r10     0x24cdedd14d0
[2022-07-07T13:46:54.692Z] r11     0xc000eb3b00
[2022-07-07T13:46:54.692Z] r12     0xc000eb3b00
[2022-07-07T13:46:54.692Z] r13     0x865c7ff9b0
[2022-07-07T13:46:54.692Z] r14     0x0
[2022-07-07T13:46:54.692Z] r15     0x24cdee180d8
[2022-07-07T13:46:54.692Z] rip     0x7ff835e0d2e6
[2022-07-07T13:46:54.692Z] rflags  0x10246
[2022-07-07T13:46:54.692Z] cs      0x33
[2022-07-07T13:46:54.692Z] fs      0x53
[2022-07-07T13:46:54.692Z] gs      0x2b
[2022-07-07T13:46:54.692Z] 
[2022-07-07T13:46:54.692Z] === FAIL: x-pack/winlogbeat/module/security/test TestSecurity (unknown)
[2022-07-07T13:46:54.692Z] Exception 0xc0000005 0x1 0xc000eb43d6 0x7ff835e0d2e6
[2022-07-07T13:46:54.692Z] PC=0x7ff835e0d2e6
[2022-07-07T13:46:54.692Z] 
[2022-07-07T13:46:54.692Z] runtime.cgocall(0xd4ce40, 0xc000089ee0)
[2022-07-07T13:46:54.692Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/.gvm/versions/go1.17.11.windows.amd64/src/runtime/cgocall.go:156 +0x4a fp=0xc000a92480 sp=0xc000a92448 pc=0xce45ea
[2022-07-07T13:46:54.692Z] syscall.Syscall9(0x7ff835e0cb10, 0x9, 0xb, 0x0, 0xb0001424, 0x63, 0xc00013e948, 0x8, 0x46c, 0xc000eb3b00, ...)
[2022-07-07T13:46:54.692Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/.gvm/versions/go1.17.11.windows.amd64/src/runtime/syscall_windows.go:510 +0xdb fp=0xc000a924a8 sp=0xc000a92480 pc=0xd47c9b
[2022-07-07T13:46:54.692Z] syscall.Syscall9(0x101000000000007, 0x24ce4b8ddd8, 0x0, 0x46c, 0x24cdef60eb8, 0x480, 0xc000089c00, 0xc000eb3b00, 0x0, 0xc000eb3b00, ...)
[2022-07-07T13:46:54.692Z] 	<autogenerated>:1 +0x59 fp=0xc000a92528 sp=0xc000a924a8 pc=0xd4de39
[2022-07-07T13:46:54.692Z] github.com/elastic/beats/v7/winlogbeat/sys/wineventlog._EvtFormatMessage(0xc000a925e8, 0xd, 0xb0001424, 0x63, 0xc000a92624, 0x8, 0x46c, 0xc000eb3b00, 0xc000a92600)
[2022-07-07T13:46:54.692Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/src/github.com/elastic/beats/winlogbeat/sys/wineventlog/zsyscall_windows.go:132 +0x105 fp=0xc000a925c0 sp=0xc000a92528 pc=0x15a2c45
[2022-07-07T13:46:54.692Z] github.com/elastic/beats/v7/winlogbeat/sys/wineventlog.evtFormatMessage(0xc000602d00, 0xc00030f6b7, 0x25375a0, {0xc00013e948, 0x63, 0xc000a92750}, 0x1596705)
[2022-07-07T13:46:54.692Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/src/github.com/elastic/beats/winlogbeat/sys/wineventlog/format_message.go:92 +0x1b6 fp=0xc000a92690 sp=0xc000a925c0 pc=0x1593956
[2022-07-07T13:46:54.692Z] github.com/elastic/beats/v7/winlogbeat/sys/wineventlog.getMessageString(0x400, 0x25375a0, 0x399dd0, {0xc00013e948, 0xb, 0x38d})
[2022-07-07T13:46:54.692Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/src/github.com/elastic/beats/winlogbeat/sys/wineventlog/format_message.go:58 +0x45 fp=0xc000a926d8 sp=0xc000a92690 pc=0x15936e5
[2022-07-07T13:46:54.692Z] github.com/elastic/beats/v7/winlogbeat/sys/wineventlog.(*EventMetadata).initEventMessage(0xc00063e1c0, 0xd, 0x0)
[2022-07-07T13:46:54.692Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/src/github.com/elastic/beats/winlogbeat/sys/wineventlog/metadata_store.go:405 +0x73 fp=0xc000a92760 sp=0xc000a926d8 pc=0x15967d3
[2022-07-07T13:46:54.692Z] github.com/elastic/beats/v7/winlogbeat/sys/wineventlog.newEventMetadataFromPublisherMetadata(0xc000642450, 0xc000642480)
[2022-07-07T13:46:54.692Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/src/github.com/elastic/beats/winlogbeat/sys/wineventlog/metadata_store.go:345 +0x9c fp=0xc000a92810 sp=0xc000a92760 pc=0x159639c
[2022-07-07T13:46:54.692Z] github.com/elastic/beats/v7/winlogbeat/sys/wineventlog.(*PublisherMetadataStore).initEvents(0xc00063cba0)
[2022-07-07T13:46:54.693Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/src/github.com/elastic/beats/winlogbeat/sys/wineventlog/metadata_store.go:181 +0x105 fp=0xc000a928d0 sp=0xc000a92810 pc=0x1595265
[2022-07-07T13:46:54.693Z] github.com/elastic/beats/v7/winlogbeat/sys/wineventlog.NewPublisherMetadataStore(0xc000642060, {0xc000e4b830, 0x23}, 0x23)
[2022-07-07T13:46:54.693Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/src/github.com/elastic/beats/winlogbeat/sys/wineventlog/metadata_store.go:81 +0x199 fp=0xc000a929c8 sp=0xc000a928d0 pc=0x15947d9
[2022-07-07T13:46:54.693Z] github.com/elastic/beats/v7/winlogbeat/eventlog.(*winMetaCache).winMeta(0xc000632640, {0xc000e4b830, 0x23})
[2022-07-07T13:46:54.693Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/src/github.com/elastic/beats/winlogbeat/eventlog/wineventlog.go:470 +0x1d6 fp=0xc000a92a88 sp=0xc000a929c8 pc=0x15ac576
[2022-07-07T13:46:54.693Z] github.com/elastic/beats/v7/winlogbeat/eventlog.(*winEventLog).buildRecordFromXML(_, {_, _, _}, {_, _})
[2022-07-07T13:46:54.693Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/src/github.com/elastic/beats/winlogbeat/eventlog/wineventlog.go:406 +0x493 fp=0xc000a932e0 sp=0xc000a92a88 pc=0x15ac093
[2022-07-07T13:46:54.693Z] github.com/elastic/beats/v7/winlogbeat/eventlog.(*winEventLog).Read(0xc0006324e0)
[2022-07-07T13:46:54.693Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/src/github.com/elastic/beats/winlogbeat/eventlog/wineventlog.go:323 +0x5c5 fp=0xc000a938e0 sp=0xc000a932e0 pc=0x15aaf85
[2022-07-07T13:46:54.693Z] github.com/elastic/beats/v7/x-pack/winlogbeat/module.testCollectionPipeline({0x2ccd190, 0xc0006321a0}, {0xc000392660, 0x2c}, 0xc0002ecdb0)
[2022-07-07T13:46:54.693Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/src/github.com/elastic/beats/x-pack/winlogbeat/module/testing_windows.go:83 +0x445 fp=0xc000a93f38 sp=0xc000a938e0 pc=0x15b1ce5
[2022-07-07T13:46:54.693Z] github.com/elastic/beats/v7/x-pack/winlogbeat/module.TestCollectionPipeline.func1(0x24cdef60eb8)
[2022-07-07T13:46:54.693Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/src/github.com/elastic/beats/x-pack/winlogbeat/module/testing_windows.go:52 +0x32 fp=0xc000a93f70 sp=0xc000a93f38 pc=0x15b1872
[2022-07-07T13:46:54.693Z] testing.tRunner(0xc0006321a0, 0xc000ccf4e8)
[2022-07-07T13:46:54.693Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/.gvm/versions/go1.17.11.windows.amd64/src/testing/testing.go:1259 +0x102 fp=0xc000a93fc0 sp=0xc000a93f70 pc=0xe09bc2
[2022-07-07T13:46:54.693Z] testing.(*T).Run·dwrap·21()
[2022-07-07T13:46:54.693Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/.gvm/versions/go1.17.11.windows.amd64/src/testing/testing.go:1306 +0x2a fp=0xc000a93fe0 sp=0xc000a93fc0 pc=0xe0a8ca
[2022-07-07T13:46:54.693Z] runtime.goexit()
[2022-07-07T13:46:54.693Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/.gvm/versions/go1.17.11.windows.amd64/src/runtime/asm_amd64.s:1581 +0x1 fp=0xc000a93fe8 sp=0xc000a93fe0 pc=0xd4b581
[2022-07-07T13:46:54.693Z] created by testing.(*T).Run
[2022-07-07T13:46:54.693Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/.gvm/versions/go1.17.11.windows.amd64/src/testing/testing.go:1306 +0x35a
[2022-07-07T13:46:54.693Z] 
[2022-07-07T13:46:54.693Z] goroutine 1 [chan receive]:
[2022-07-07T13:46:54.693Z] testing.(*T).Run(0xc0006049c0, {0x285a132, 0xd4e193}, 0x29dbdf8)
[2022-07-07T13:46:54.693Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/.gvm/versions/go1.17.11.windows.amd64/src/testing/testing.go:1307 +0x375
[2022-07-07T13:46:54.693Z] testing.runTests.func1(0xc000849410)
[2022-07-07T13:46:54.693Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/.gvm/versions/go1.17.11.windows.amd64/src/testing/testing.go:1598 +0x6e
[2022-07-07T13:46:54.693Z] testing.tRunner(0xc0006049c0, 0xc00081fce0)
[2022-07-07T13:46:54.693Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/.gvm/versions/go1.17.11.windows.amd64/src/testing/testing.go:1259 +0x102
[2022-07-07T13:46:54.693Z] testing.runTests(0xc0000c3c00, {0x3ec4360, 0x1, 0x1}, {0xd7b02d, 0x285e797, 0x3ef0060})
[2022-07-07T13:46:54.693Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/.gvm/versions/go1.17.11.windows.amd64/src/testing/testing.go:1596 +0x43f
[2022-07-07T13:46:54.693Z] testing.(*M).Run(0xc0000c3c00)
[2022-07-07T13:46:54.693Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/.gvm/versions/go1.17.11.windows.amd64/src/testing/testing.go:1504 +0x51d
[2022-07-07T13:46:54.693Z] main.main()
[2022-07-07T13:46:54.693Z] 	_testmain.go:85 +0x1f5
[2022-07-07T13:46:54.693Z] 
[2022-07-07T13:46:54.693Z] goroutine 21 [chan receive]:
[2022-07-07T13:46:54.693Z] github.com/klauspost/compress/zstd.(*blockDec).startDecoder(0xc0005236c0)
[2022-07-07T13:46:54.693Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/pkg/mod/github.com/klauspost/compress@v1.13.6/zstd/blockdec.go:212 +0x94
[2022-07-07T13:46:54.693Z] created by github.com/klauspost/compress/zstd.newBlockDec
[2022-07-07T13:46:54.693Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/pkg/mod/github.com/klauspost/compress@v1.13.6/zstd/blockdec.go:118 +0x167
[2022-07-07T13:46:54.693Z] 
[2022-07-07T13:46:54.693Z] goroutine 22 [chan receive]:
[2022-07-07T13:46:54.693Z] github.com/klauspost/compress/zstd.(*blockDec).startDecoder(0xc000523790)
[2022-07-07T13:46:54.693Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/pkg/mod/github.com/klauspost/compress@v1.13.6/zstd/blockdec.go:212 +0x94
[2022-07-07T13:46:54.693Z] created by github.com/klauspost/compress/zstd.newBlockDec
[2022-07-07T13:46:54.693Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/pkg/mod/github.com/klauspost/compress@v1.13.6/zstd/blockdec.go:118 +0x167
[2022-07-07T13:46:54.693Z] 
[2022-07-07T13:46:54.693Z] goroutine 23 [chan receive]:
[2022-07-07T13:46:54.693Z] github.com/klauspost/compress/zstd.(*blockDec).startDecoder(0xc000523860)
[2022-07-07T13:46:54.693Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/pkg/mod/github.com/klauspost/compress@v1.13.6/zstd/blockdec.go:212 +0x94
[2022-07-07T13:46:54.693Z] created by github.com/klauspost/compress/zstd.newBlockDec
[2022-07-07T13:46:54.693Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/pkg/mod/github.com/klauspost/compress@v1.13.6/zstd/blockdec.go:118 +0x167
[2022-07-07T13:46:54.693Z] 
[2022-07-07T13:46:54.693Z] goroutine 24 [chan receive]:
[2022-07-07T13:46:54.693Z] github.com/klauspost/compress/zstd.(*blockDec).startDecoder(0xc000523930)
[2022-07-07T13:46:54.693Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/pkg/mod/github.com/klauspost/compress@v1.13.6/zstd/blockdec.go:212 +0x94
[2022-07-07T13:46:54.693Z] created by github.com/klauspost/compress/zstd.newBlockDec
[2022-07-07T13:46:54.693Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/pkg/mod/github.com/klauspost/compress@v1.13.6/zstd/blockdec.go:118 +0x167
[2022-07-07T13:46:54.693Z] 
[2022-07-07T13:46:54.693Z] goroutine 25 [chan receive]:
[2022-07-07T13:46:54.693Z] github.com/klauspost/compress/zstd.(*blockDec).startDecoder(0xc000523a00)
[2022-07-07T13:46:54.693Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/pkg/mod/github.com/klauspost/compress@v1.13.6/zstd/blockdec.go:212 +0x94
[2022-07-07T13:46:54.693Z] created by github.com/klauspost/compress/zstd.newBlockDec
[2022-07-07T13:46:54.693Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/pkg/mod/github.com/klauspost/compress@v1.13.6/zstd/blockdec.go:118 +0x167
[2022-07-07T13:46:54.693Z] 
[2022-07-07T13:46:54.693Z] goroutine 26 [chan receive]:
[2022-07-07T13:46:54.693Z] github.com/klauspost/compress/zstd.(*blockDec).startDecoder(0xc000523ad0)
[2022-07-07T13:46:54.693Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/pkg/mod/github.com/klauspost/compress@v1.13.6/zstd/blockdec.go:212 +0x94
[2022-07-07T13:46:54.693Z] created by github.com/klauspost/compress/zstd.newBlockDec
[2022-07-07T13:46:54.693Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/pkg/mod/github.com/klauspost/compress@v1.13.6/zstd/blockdec.go:118 +0x167
[2022-07-07T13:46:54.693Z] 
[2022-07-07T13:46:54.693Z] goroutine 27 [chan receive]:
[2022-07-07T13:46:54.693Z] github.com/klauspost/compress/zstd.(*blockDec).startDecoder(0xc000523ba0)
[2022-07-07T13:46:54.693Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/pkg/mod/github.com/klauspost/compress@v1.13.6/zstd/blockdec.go:212 +0x94
[2022-07-07T13:46:54.693Z] created by github.com/klauspost/compress/zstd.newBlockDec
[2022-07-07T13:46:54.693Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/pkg/mod/github.com/klauspost/compress@v1.13.6/zstd/blockdec.go:118 +0x167
[2022-07-07T13:46:54.693Z] 
[2022-07-07T13:46:54.693Z] goroutine 28 [chan receive]:
[2022-07-07T13:46:54.693Z] github.com/klauspost/compress/zstd.(*blockDec).startDecoder(0xc000523c70)
[2022-07-07T13:46:54.693Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/pkg/mod/github.com/klauspost/compress@v1.13.6/zstd/blockdec.go:212 +0x94
[2022-07-07T13:46:54.693Z] created by github.com/klauspost/compress/zstd.newBlockDec
[2022-07-07T13:46:54.693Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/pkg/mod/github.com/klauspost/compress@v1.13.6/zstd/blockdec.go:118 +0x167
[2022-07-07T13:46:54.693Z] 
[2022-07-07T13:46:54.693Z] goroutine 11 [chan receive]:
[2022-07-07T13:46:54.693Z] k8s.io/klog/v2.(*loggingT).flushDaemon(0x0)
[2022-07-07T13:46:54.694Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/pkg/mod/k8s.io/klog/v2@v2.30.0/klog.go:1181 +0x6a
[2022-07-07T13:46:54.694Z] created by k8s.io/klog/v2.init.0
[2022-07-07T13:46:54.694Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/pkg/mod/k8s.io/klog/v2@v2.30.0/klog.go:420 +0xfb
[2022-07-07T13:46:54.694Z] 
[2022-07-07T13:46:54.694Z] goroutine 29 [chan receive]:
[2022-07-07T13:46:54.694Z] testing.(*T).Run(0xc000604b60, {0xc000392674, 0x87}, 0xc000ccf4e8)
[2022-07-07T13:46:54.694Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/.gvm/versions/go1.17.11.windows.amd64/src/testing/testing.go:1307 +0x375
[2022-07-07T13:46:54.694Z] github.com/elastic/beats/v7/x-pack/winlogbeat/module.TestCollectionPipeline(0xc000604b60, {0x2874dc9, 0x1a}, {0xc0000a1f38, 0x1, 0xd4e193})
[2022-07-07T13:46:54.694Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/src/github.com/elastic/beats/x-pack/winlogbeat/module/testing_windows.go:51 +0x372
[2022-07-07T13:46:54.694Z] github.com/elastic/beats/v7/x-pack/winlogbeat/module/security/test.TestSecurity(0x0)
[2022-07-07T13:46:54.694Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/src/github.com/elastic/beats/x-pack/winlogbeat/module/security/test/security_windows_test.go:24 +0x85
[2022-07-07T13:46:54.694Z] testing.tRunner(0xc000604b60, 0x29dbdf8)
[2022-07-07T13:46:54.694Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/.gvm/versions/go1.17.11.windows.amd64/src/testing/testing.go:1259 +0x102
[2022-07-07T13:46:54.694Z] created by testing.(*T).Run
[2022-07-07T13:46:54.694Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/.gvm/versions/go1.17.11.windows.amd64/src/testing/testing.go:1306 +0x35a
[2022-07-07T13:46:54.694Z] 
[2022-07-07T13:46:54.694Z] goroutine 66 [select]:
[2022-07-07T13:46:54.694Z] github.com/elastic/beats/v7/libbeat/common.(*Cache).StartJanitor.func1()
[2022-07-07T13:46:54.694Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/src/github.com/elastic/beats/libbeat/common/cache.go:245 +0x85
[2022-07-07T13:46:54.694Z] created by github.com/elastic/beats/v7/libbeat/common.(*Cache).StartJanitor
[2022-07-07T13:46:54.694Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/src/github.com/elastic/beats/libbeat/common/cache.go:243 +0xb2
[2022-07-07T13:46:54.694Z] 
[2022-07-07T13:46:54.694Z] goroutine 90 [select]:
[2022-07-07T13:46:54.694Z] github.com/elastic/beats/v7/libbeat/common.(*Cache).StartJanitor.func1()
[2022-07-07T13:46:54.694Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/src/github.com/elastic/beats/libbeat/common/cache.go:245 +0x85
[2022-07-07T13:46:54.694Z] created by github.com/elastic/beats/v7/libbeat/common.(*Cache).StartJanitor
[2022-07-07T13:46:54.694Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/src/github.com/elastic/beats/libbeat/common/cache.go:243 +0xb2
[2022-07-07T13:46:54.694Z] 
[2022-07-07T13:46:54.694Z] goroutine 213 [select]:
[2022-07-07T13:46:54.694Z] github.com/elastic/beats/v7/libbeat/common.(*Cache).StartJanitor.func1()
[2022-07-07T13:46:54.694Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/src/github.com/elastic/beats/libbeat/common/cache.go:245 +0x85
[2022-07-07T13:46:54.694Z] created by github.com/elastic/beats/v7/libbeat/common.(*Cache).StartJanitor
[2022-07-07T13:46:54.694Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/src/github.com/elastic/beats/libbeat/common/cache.go:243 +0xb2
[2022-07-07T13:46:54.694Z] 
[2022-07-07T13:46:54.694Z] goroutine 165 [select]:
[2022-07-07T13:46:54.694Z] github.com/elastic/beats/v7/libbeat/common.(*Cache).StartJanitor.func1()
[2022-07-07T13:46:54.694Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/src/github.com/elastic/beats/libbeat/common/cache.go:245 +0x85
[2022-07-07T13:46:54.694Z] created by github.com/elastic/beats/v7/libbeat/common.(*Cache).StartJanitor
[2022-07-07T13:46:54.694Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/src/github.com/elastic/beats/libbeat/common/cache.go:243 +0xb2
[2022-07-07T13:46:54.694Z] 
[2022-07-07T13:46:54.694Z] goroutine 264 [select]:
[2022-07-07T13:46:54.694Z] github.com/elastic/beats/v7/libbeat/common.(*Cache).StartJanitor.func1()
[2022-07-07T13:46:54.694Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/src/github.com/elastic/beats/libbeat/common/cache.go:245 +0x85
[2022-07-07T13:46:54.694Z] created by github.com/elastic/beats/v7/libbeat/common.(*Cache).StartJanitor
[2022-07-07T13:46:54.694Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/src/github.com/elastic/beats/libbeat/common/cache.go:243 +0xb2
[2022-07-07T13:46:54.694Z] 
[2022-07-07T13:46:54.694Z] goroutine 704 [select]:
[2022-07-07T13:46:54.694Z] github.com/elastic/beats/v7/libbeat/common.(*Cache).StartJanitor.func1()
[2022-07-07T13:46:54.694Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/src/github.com/elastic/beats/libbeat/common/cache.go:245 +0x85
[2022-07-07T13:46:54.694Z] created by github.com/elastic/beats/v7/libbeat/common.(*Cache).StartJanitor
[2022-07-07T13:46:54.694Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/src/github.com/elastic/beats/libbeat/common/cache.go:243 +0xb2
[2022-07-07T13:46:54.694Z] 
[2022-07-07T13:46:54.694Z] goroutine 1184 [select]:
[2022-07-07T13:46:54.694Z] github.com/elastic/beats/v7/libbeat/common.(*Cache).StartJanitor.func1()
[2022-07-07T13:46:54.694Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/src/github.com/elastic/beats/libbeat/common/cache.go:245 +0x85
[2022-07-07T13:46:54.694Z] created by github.com/elastic/beats/v7/libbeat/common.(*Cache).StartJanitor
[2022-07-07T13:46:54.694Z] 	C:/Users/jenkins/workspace/PR-32236-3-a216ae60-6c90-4888-b5d1-84f8625e5cea/src/github.com/elastic/beats/libbeat/common/cache.go:243 +0xb2
[2022-07-07T13:46:54.694Z] rax     0x46b
[2022-07-07T13:46:54.694Z] rbx     0x0
[2022-07-07T13:46:54.694Z] rcx     0x0
[2022-07-07T13:46:54.694Z] rdi     0x46c
[2022-07-07T13:46:54.694Z] rsi     0x24cdee17790
[2022-07-07T13:46:54.694Z] rbp     0x865c7ff8e0
[2022-07-07T13:46:54.694Z] rsp     0x865c7ff7e0
[2022-07-07T13:46:54.694Z] r8      0x46c
[2022-07-07T13:46:54.694Z] r9      0x3e
[2022-07-07T13:46:54.694Z] r10     0x24cdedd14d0
[2022-07-07T13:46:54.694Z] r11     0xc000eb3b00
[2022-07-07T13:46:54.694Z] r12     0xc000eb3b00
[2022-07-07T13:46:54.694Z] r13     0x865c7ff9b0
[2022-07-07T13:46:54.694Z] r14     0x0
[2022-07-07T13:46:54.694Z] r15     0x24cdee180d8
[2022-07-07T13:46:54.694Z] rip     0x7ff835e0d2e6
[2022-07-07T13:46:54.694Z] rflags  0x10246
[2022-07-07T13:46:54.694Z] cs      0x33
[2022-07-07T13:46:54.694Z] fs      0x53
[2022-07-07T13:46:54.694Z] gs      0x2b
[2022-07-07T13:46:54.694Z] 
[2022-07-07T13:46:54.694Z] === FAIL: x-pack/winlogbeat/module/security/test TestSecurity/1100.evtx (unknown)
[2022-07-07T13:46:54.694Z] 
[2022-07-07T13:46:54.694Z] DONE 30 tests, 8 failures in 223.238s
[2022-07-07T13:46:54.954Z] Error: failed to execute go: exit status 1
script returned exit code 1

@v1v v1v added the flaky-test Unstable or unreliable test cases. label Jul 22, 2022
@botelastic botelastic bot added the needs_team Indicates that the issue/PR needs a Team:* label label Jul 22, 2022
@elasticmachine
Copy link
Collaborator

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

@botelastic botelastic bot removed the needs_team Indicates that the issue/PR needs a Team:* label label Jul 22, 2022
@efd6
Copy link
Contributor

efd6 commented Jul 24, 2022

This looks like a buffer overflow; the there is a STATUS_ACCESS_VIOLATION write at 0xc000eb43d6 which looks most likely to be targetting the caller-allocated buffer (0xc000eb3b00 in the stack trace). The overrun is by about 2×, so maybe this is a utf16 v byte confusion? Though that already seems to be taken into account, so it seems unlikely.

@adriansr
Copy link
Contributor

@efd6 I think I've found the error.

  • The first call to EvtFormatMessage returns the expected buffer length in characters (in bufferUsed).
  • We allocate a buffer of 2*bufferUsed bytes in bb (correct).
  • Then we call EvtFormatMessage passing the size of this buffer in bytes (uint32(bb.Len)), while it is expecting the size of the buffer in characters.

Passing the original bufferUsed in the second call fixes the problem for me.

I guess Windows 11 may be zeroing the whole buffer we pass.

@efd6
Copy link
Contributor

efd6 commented Jul 26, 2022

Nice work.

andrewkroh added a commit to andrewkroh/beats that referenced this issue Dec 9, 2022
A panic was observed on Windows 2022 after using the returned bufferUsed
value to index into the buffer allocated on the Winlogbeat side. The returned value
was larger than the buffer. We saw a similar issue previously on elastic#32469 and we
the fix here is similar.

I have also done some refactoring to remove the usage of the "render buffer". Instead
of requiring callers to pass in a buffer we will use a buffer obtained from a sync.Pool.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
flaky-test Unstable or unreliable test cases.
Projects
None yet
Development

Successfully merging a pull request may close this issue.

5 participants