[Winlogbeat] in windows-2008-r2 got some flakiness tests for test.TestSysmon/wineventlog.TestFormatMessage

[v1v]

Flaky Test

• Test Name: test.TestSysmon/** and wineventlog.TestFormatMessage/**
• Link:

  • beats/x-pack/winlogbeat/module/sysmon/test/sysmon_windows_test.go

    Line 25 in 57c4280

    func TestSysmon(t *testing.T) {

  • beats/winlogbeat/sys/wineventlog/format_message_test.go

    Line 29 in 57c4280

    func TestFormatMessage(t *testing.T) {

• Branch: [CI] support windows-2008-r2 #19791
• Artifact Link: https://gist.github.com/v1v/d0f532f973aab94fedaf9cc76488a2b1
• Notes:
  https://beats-ci.elastic.co/job/Beats/job/beats-windows-mbp/job/PR-19791/1/execution/node/1350/log/ and https://beats-ci.elastic.co/job/Beats/job/beats-windows-mbp/job/PR-19791/1/execution/node/1202/log/ <-- these might not be accessible in the future, therefore access the artifact link

Stack Trace

winlogbeat

15:43:26  C:\Users\jenkins\workspace\Beats_beats-windows-mbp_PR-19791\src\github.com\elastic\beats\winlogbeat>mage  build unitTest 
15:44:05  >> build: Building winlogbeat
15:44:51  Generated fields.yml for winlogbeat to C:\Users\jenkins\workspace\Beats_beats-windows-mbp_PR-19791\src\github.com\elastic\beats\winlogbeat\build\fields\fields.common.yml
15:44:51  Generated fields.yml for winlogbeat to C:\Users\jenkins\workspace\Beats_beats-windows-mbp_PR-19791\src\github.com\elastic\beats\winlogbeat\build\fields\fields.all.yml
15:44:51  Generated fields.yml for winlogbeat to C:\Users\jenkins\workspace\Beats_beats-windows-mbp_PR-19791\src\github.com\elastic\beats\winlogbeat\build\fields\fields.yml
15:44:51  >> go test: Unit Testing
15:49:43  FAILURES:
15:49:43  Package: github.com/elastic/beats/v7/winlogbeat/sys/wineventlog
15:49:43  Test:    TestFormatMessage
15:49:43  ----
15:49:43  Package: github.com/elastic/beats/v7/winlogbeat/sys/wineventlog
15:49:43  Test:    TestFormatMessage/getMessageStringFromHandle
15:49:43  ----
15:49:43  Package: github.com/elastic/beats/v7/winlogbeat/sys/wineventlog
15:49:43  Test:    TestFormatMessage/getMessageStringFromHandle/custom_values
15:49:43      TestFormatMessage/getMessageStringFromHandle/custom_values: format_message_test.go:78: 
15:49:43  ----
15:49:43  SUMMARY:
15:49:43    Fail:     3
15:49:43    Skip:     1
15:49:43    Pass:     145
15:49:43    Packages: 9
15:49:43    Duration: 4m49.6826172s
15:49:43    Coverage Report: C:\Users\jenkins\workspace\Beats_beats-windows-mbp_PR-19791\src\github.com\elastic\beats\winlogbeat\build\TEST-go-unit.html
15:49:43    JUnit Report:    C:\Users\jenkins\workspace\Beats_beats-windows-mbp_PR-19791\src\github.com\elastic\beats\winlogbeat\build\TEST-go-unit.xml
15:49:43    Output File:     C:\Users\jenkins\workspace\Beats_beats-windows-mbp_PR-19791\src\github.com\elastic\beats\winlogbeat\build\TEST-go-unit.out
15:49:43  >> go test: Unit Test Failed
15:49:43  Error: go test failed: 3 test failures

x-pack\winlogbeat

15:42:24  C:\Users\jenkins\workspace\Beats_beats-windows-mbp_PR-19791\src\github.com\elastic\beats\x-pack\winlogbeat>mage  build unitTest 
15:43:03  >> build: Building winlogbeat
15:43:59  Generated fields.yml for winlogbeat to C:\Users\jenkins\workspace\Beats_beats-windows-mbp_PR-19791\src\github.com\elastic\beats\x-pack\winlogbeat\build\fields\fields.all.yml
15:43:59  Generated fields.yml for winlogbeat to C:\Users\jenkins\workspace\Beats_beats-windows-mbp_PR-19791\src\github.com\elastic\beats\x-pack\winlogbeat\build\fields\fields.yml
15:43:59  >> go test: Unit Testing
15:46:06  FAILURES:
15:46:06  Package: github.com/elastic/beats/v7/x-pack/winlogbeat/module/sysmon/test
15:46:06  Test:    TestSysmon
15:46:06  ----
15:46:06  Package: github.com/elastic/beats/v7/x-pack/winlogbeat/module/sysmon/test
15:46:06  Test:    TestSysmon/sysmon-10.2-dns.evtx
15:46:06      TestSysmon/sysmon-10.2-dns.evtx: testing_windows.go:70: Expected and actual are different:
15:46:06          --- Expected
15:46:06          +++ Actual
15:46:06          @@ -74,6 +74,3 @@
15:46:06               "user": {
15:46:06          -      "domain": "NT AUTHORITY",
15:46:06          -      "identifier": "S-1-5-18",
15:46:06          -      "name": "SYSTEM",
15:46:06          -      "type": "Well Known Group"
15:46:06          +      "identifier": "S-1-5-18"
15:46:06               },
...

[elasticmachine]

Pinging @elastic/siem (Team:SIEM)