Memory leak in Windows reading from the EventChannel

[chemamartinez]

Bug report

OS
Windows

Wazuh version
3.8.0-3805

Install type
agent

Install method
packages/sources

Log sample

ossec-agent: CRITICAL: (1102): Could not acquire memory due to [(12)-(Not enough space)].

Bug description

This is a bug reported in the Wazuh mailing list (https://groups.google.com/forum/?nomobile=true#!topic/wazuh/wMDY942F20A).

It consists of a memory leak when parsing Windows events read from the Event-channel which makes the agent lost memory until it crashes. It has been introduced in Windows agents v3.8.0 in the Logcollector component when monitoring the EventChannel with the following configuration sample:

<localfile>
  <log_format>eventchannel</log_format>
  ...
</localfile>

Really appreciated the feedback from users who reported the error.

Regards.