Windows Event Collector (WEC) Systems stopped logging after Windows upgrade. (4271251)

Windows Event Collector (WEC) Systems stopped logging after Windows upgrade.

Windows Event Collector (WEC) Systems stopped logging after Windows upgrade.

Missing events from Windows systems sending to the Windows Event Collector (WEC) after upgrading Windows.

Possible parser mismatch for event timestamp.

Check to determine if a parser exists for the Windows events that could be discarding events due to the timestamp.

For example:
 parser p_win {date-parser(format("%Y-%m-%dT%X") template("$(substr ${.SDATA.Event.System.TimeCreated._SystemTime} 0 -11)") ); };

This will match the date format:
2022-03-15T15:18:16.125971500Z

But does not match this one:
2022-03-14T09:09:18.4244253Z

There is a -11 char offset.
If that applies on the shorter time format it will cut additional 2 characters.
The result "YYYY:MM:DDTHH:mm:" does not match the format().



RESOLUTION:

Try using the following parser which will match the first 19 characters:
parser p_win  {date-parser(format("%Y-%m-%dT%X") template("$(substr ${.SDATA.Event.System.TimeCreated._SystemTime} 0 19)") ); })