Windows event logs not appearing (wsasend: An existing connection was forcibly closed by the remote host)

[wilmerism]

Version

2.4.40

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Standalone

Location

on-prem with Internet access

Hardware Specs

Meets minimum requirements

CPU

4

RAM

16

Storage for /

1tb

Storage for /nsm

1tb

Network Traffic Collection

span port

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Afternoon,
Is a new Install of SECO 2.4.40 , Have prev versions running ok in other sites wo happy with basiscs.

New install, I just am not seeing windows events coming in. (havent moved onto others yet)
Is on hyper V - I have deleted & rebuilt still no good

Now testing in my lab environment (192.168.100.x) (hyper V also) i still can tget logs to appear>

All Agents healthy in fleet

I am using the elastic installer from https://192.168.100.40/#/downloads

Firewall settings >
https://192.168.100.40/#/config?s=firewall.hostgroups.elastic_agent_endpoint = 192.168.100.0/24
https://192.168.100.40/#/config?s=firewall.hostgroups.fleet = 192.168.100.0/24

Agent status >
C:\Program Files\Elastic\Agent\data\elastic-agent-a92ca3>elastic-agent.exe status
┌─ fleet
│ └─ status: (HEALTHY) Connected
└─ elastic-agent
└─ status: (HEALTHY) Running

Ive seen ticket "#11142"
so rather than remove elastic defend i ve put in a differnt "agent policy" below are the errors i see from agents in teh 2 difffering policys

"PC1" - resides in "endpoints-initial"
failed to publish events: write tcp 192.168.100.22:51088->192.168.100.40:5055: wsasend: An existing connection was forcibly closed by the remote host.

"PC2" - resides in "so-grid-nodes_general"
failed to publish events: write tcp 192.168.100.18:52855->192.168.100.40:5055: wsasend: An existing connection was forcibly closed by the remote host.

Im sure its osmethign silly, I have searchd plenty, after pointers please?

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[wilmerism]

Update - Agests started reporting in 12 hrs after instal on both my test and live systems.... Both 4 cores, 20 gig ram...

[InfosecGoon]

Sounds like there was a delay in applying those firewall hostgroup rules -- everything is working as expected now?