Skip to content

winevtlog - incorrect timestamp value in timecreated #8086

@Paul-Vi

Description

@Paul-Vi

Bug Report

Describe the bug
Issue 1:
winevtlog plugin - local time with incorrect timezone (+100) is logged in timecreated.
Correct value: +200 , CEST (UTC+02:00) Maybe summer daylight-saving is ignored.
winlog plugin - timezone is correct +200 (in "TimeGenerated" , "TimeWritten")

Issue 2:
In both plugins timestamp has time format HH:MM:SS
Miliseconds are omitted/rounded.
In security channel all events have time format HH:MM:SS.sssssss
Exact time can be logged only using parameter Render_Event_As_XML=true e.g. 2023-10-25T12:48:08.624665800Z

To Reproduce
fluent-bit -i winevtlog -p channels=Security -o file -p path=C:\temp
fluent-bit -i winlog -p channels=Security -o file -p path=C:\temp\

fluent-bit -i winevtlog -p channels=Security -p Render_Event_As_XML=true -o file -p path=C:\temp\

Your Environment

  • Version used: 2.1.10
  • Configuration:
  • Environment name and version (e.g. Kubernetes? What version?):
  • Server type and version:
  • Operating System and version: Windows server 2019
  • Filters and plugins:

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions