https://community.splunk.com/t5/Getting-Data-In/enormous-amounts-of-EventCode-4674/m-p/105353#M22192 <P>Hello everybody,</P> <P>i have a server that produces <STRONG>per minute</STRONG> 13000 security logs with the EventCode=4674 (An operation was attempted on a privileged object).<BR /> what is the problem and how can i fix it?</P> Wed, 24 Apr 2013 16:16:14 GMT saschar 2013-04-24T16:16:14Z https://community.splunk.com/t5/Getting-Data-In/enormous-amounts-of-EventCode-4674/m-p/105353#M22192 <P>Hello everybody,</P> <P>i have a server that produces <STRONG>per minute</STRONG> 13000 security logs with the EventCode=4674 (An operation was attempted on a privileged object).<BR /> what is the problem and how can i fix it?</P> Wed, 24 Apr 2013 16:16:14 GMT https://community.splunk.com/t5/Getting-Data-In/enormous-amounts-of-EventCode-4674/m-p/105353#M22192 saschar 2013-04-24T16:16:14Z https://community.splunk.com/t5/Getting-Data-In/enormous-amounts-of-EventCode-4674/m-p/105354#M22193 <P>One option is to adjust your object-level auditing in Windows to a more appropriate level, if this is too verbose.</P> Wed, 24 Apr 2013 16:37:35 GMT https://community.splunk.com/t5/Getting-Data-In/enormous-amounts-of-EventCode-4674/m-p/105354#M22193 sbrant_splunk 2013-04-24T16:37:35Z https://community.splunk.com/t5/Getting-Data-In/enormous-amounts-of-EventCode-4674/m-p/105355#M22194 <P>mhmm, and perhaps figure out WHICH object, WHAT operation and WHO did (attempt) it. Just to be sure, mkay?</P> Wed, 24 Apr 2013 18:01:04 GMT https://community.splunk.com/t5/Getting-Data-In/enormous-amounts-of-EventCode-4674/m-p/105355#M22194 kristian_kolb 2013-04-24T18:01:04Z https://community.splunk.com/t5/Getting-Data-In/enormous-amounts-of-EventCode-4674/m-p/105356#M22195 <P>touche. I did say ONE option though <span class="lia-unicode-emoji" title=":winking_face:">😉</span></P> Wed, 24 Apr 2013 19:15:56 GMT https://community.splunk.com/t5/Getting-Data-In/enormous-amounts-of-EventCode-4674/m-p/105356#M22195 sbrant_splunk 2013-04-24T19:15:56Z https://community.splunk.com/t5/Getting-Data-In/enormous-amounts-of-EventCode-4674/m-p/105357#M22196 <P>That option sure is the correct way to cure the symptom - and maybe also the disease. Even if there are a looot of events on a windows box, there might be just about nothing going on... <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> <P>/k</P> Wed, 24 Apr 2013 20:10:25 GMT https://community.splunk.com/t5/Getting-Data-In/enormous-amounts-of-EventCode-4674/m-p/105357#M22196 kristian_kolb 2013-04-24T20:10:25Z https://community.splunk.com/t5/Getting-Data-In/enormous-amounts-of-EventCode-4674/m-p/105358#M22197 <P>You can filter those EventCodes out</P> <P>see Additional method to filter since Splunk 6.*<BR /> <A href="http://answers.splunk.com/answers/116817/filter-wineventlog-events-based-on-the-eventcodes">http://answers.splunk.com/answers/116817/filter-wineventlog-events-based-on-the-eventcodes</A></P> Tue, 31 Dec 2013 21:39:58 GMT https://community.splunk.com/t5/Getting-Data-In/enormous-amounts-of-EventCode-4674/m-p/105358#M22197 yannK 2013-12-31T21:39:58Z https://community.splunk.com/t5/Getting-Data-In/enormous-amounts-of-EventCode-4674/m-p/696850#M115624 <P>(how do I give negative Karma?)</P><P>&nbsp;</P> Tue, 20 Aug 2024 14:05:40 GMT https://community.splunk.com/t5/Getting-Data-In/enormous-amounts-of-EventCode-4674/m-p/696850#M115624 mykol_j 2024-08-20T14:05:40Z