topic Re: Sudden excessive WinEventLog:Security events involving splunkd.exe in Getting Data In

Sudden excessive WinEventLog:Security events involving splunkd.exe

nk-1 — Tue, 29 Sep 2020 16:00:03 GMT

Splunk Universal Forwarder is v6.4.x
Splunk Server is v6.5.x

In C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_windows\local\inputs.conf , I have:

[WinEventLog://Security]
disabled = 0
index = wmi

I would normally see about 240 WinEventLog://Security "splunkd.exe" events logged per hour (for weeks).
Suddenly, that number jumped to over 4 million WinEventLog://Security "splunkd.exe" events logged per hour, and my indexing limit was exceeded.

Here's what gets logged:

TIMESTAMP
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=5156
EventType=0
Type=Information
ComputerName=HOSTNAME
TaskCategory=Filtering Platform Connection
OpCode=Info
RecordNumber=X
Keywords=Audit Success
Message=The Windows Filtering Platform has permitted a connection.

Application Information:
Process ID: XXX
Application Name: \device\harddiskvolume2\program files\splunkuniversalforwarder\bin\splunkd.exe

Network Information:
Direction: Outbound
Source Address: 10.X.X.X
Source Port: XXX
Destination Address: 172.X.X.X
Destination Port: XXX
Protocol: 6

Filter Information:
Filter Run-Time ID: XXX
Layer Name: Connect
Layer Run-Time ID: X

What could have possibly changed in a Windows machine that suddenly makes it log so much WinEventLog:Security "splunkd.exe" events?

I could set disabled=1, but then I'd lose the ability to track who is logging in/out of that machine.
Is there any way to just omit logging these kind of "Audit Success" / "The Windows Filtering Platform has permitted a connection" events?

Re: Sudden excessive WinEventLog:Security events involving splunkd.exe

nk-1 — Tue, 03 Oct 2017 00:12:23 GMT

Found an answer right here - http://answers.splunk.com/answers/53422/eventcode-5156.html

auditpol /set /subcategory:"Filtering Platform Connection" /success:disable /failure:enable

Re: Sudden excessive WinEventLog:Security events involving splunkd.exe

nk-1 — Tue, 03 Oct 2017 21:01:23 GMT

The excessive WinEventLog:Security events started the day some updates were pushed to the machine:
Microsoft Security Update for .NET
McAfee product updates (including Firewall update)

Hmm... But it could have been something else that triggered it too.

Re: Sudden excessive WinEventLog:Security events involving splunkd.exe

chanthongphiob — Wed, 16 May 2018 18:54:23 GMT

Did you ever figure out why the "Application Name: \device\harddiskvolume2\program files\splunkuniversalforwarder\bin\splunkd.exe" was making excessive connections to the machine? I have also run into this issue, but would like to know the root cause of excessive connections, and not excessive logs.