Cribl Stream WEF Source Kerberos KVNO Mismatch Errors After Keytab Rotation

Symptom

After updating a keytab for a WEF (Windows Event Forwarding) source, some WEF clients fail to authenticate with KVNO mismatch errors, even though the keytab KVNO matches the KDC. Error messages reference old KVNO values:

Cannot find key for HTTP/<your-hostname>@<YOUR.REALM> kvno <old-kvno> in keytab

Not all WEF clients are affected — only a subset show the error. Verifying with kinit -kt and kvno confirms the keytab and KDC have the correct, matching KVNO.

Environment

• Cribl Stream
• WEF source with Kerberos authentication
• Recent keytab rotation or update
• krb5.conf configured with FILE or DIR cache type

Resolution

1. Confirm the keytab KVNO matches the KDC by running kinit -kt <keytab-path> <principal> and kvno <principal> on the Cribl worker.

2. On affected Windows clients, purge the cached Kerberos tickets:

   1. Run klist purge from an elevated command prompt, or use klist -li <LogonID> purge to target a specific logon session.

   2. Log off and log back on, or restart the Windows Event Forwarding service on the client.

3. Alternatively, wait for the TGT to expire naturally. The default Windows TGT lifetime is 10 hours, but this value is controlled by AD Group Policy (Maximum lifetime for user ticket) and may differ in your environment.

4. Verify that krb5.conf on the Cribl worker uses FILE or DIR as the credential cache type, not KEYRING. Cribl does not support the keyring cache type.

Cause

This can be caused by:

• Windows clients caching Kerberos tickets with the old KVNO prior to the keytab rotation. These cached tickets reference the previous KVNO, which no longer exists in the updated keytab.
• Clients that have not yet refreshed their TGT will continue presenting the old KVNO until their ticket expires or is manually purged.