topic Re: Windows Event Excessive Logs in Getting Data In

What might be the reason for excessive logs in Windows event?

omprakash9998 — Tue, 21 Feb 2023 21:27:16 GMT

I have around 800 users in my environment and the count of 4624 and 4634 is around 80,000 for the last 15 minutes. What might be the reason.

Thank you,

Re: Windows Event Excessive Logs

yannK — Tue, 19 Dec 2017 20:00:58 GMT

if your problem is too much verbose events from wineventlog, causing higher license usage
you can a use a blacklist filter on the splunk inputs.conf to exclude them from the monitoring.

see wineventlog whitelist/blacklist settings
http://docs.splunk.com/Documentation/Splunk/7.0.1/Data/MonitorWindowseventlogdata

Re: Windows Event Excessive Logs

nickhills — Tue, 19 Dec 2017 20:29:53 GMT

Pro Tip:

Decide which login events you really care about (maybe check with security team if applicable)
However, most of your 4624s will probably be LoginType 3 - Which is network access - you may see this every time you access anything on the network, even if you don't actually open/edit a file etc.

You may decide that you only care about:
LoginType 2 - Interactive (ie with a keyboard attached to the system)
Type7 - Unlocking a workstation, or
Type 10 - remote Interactive (ie RDP/remote access etc)

you could blacklist types 1,3,4,5,6,8,9 and reduce your login events to a fraction of what you have right now, whilst preserving the most important/relevant ones.

blacklist = EventCode="4624" Message="LogonType=(1|3|4|5|6|8|9)"

or to just drop type 3
blacklist1 = EventCode="4624" Message="LogonType=3"

Re: Windows Event Excessive Logs

avery2007 — Fri, 20 Mar 2020 18:42:16 GMT

Has anyone inserted this in the inputs.conf that has the appropriate regex to make this work?

Re: Windows Event Excessive Logs

96nick — Tue, 21 Feb 2023 21:18:16 GMT

While years late, hopefully this helps someone out in the future. This works:

blacklist1 = EventCode="4624" Message="Logon Type:\s+3"
blacklist2 = EventCode="4634" Message="Logon Type:\s+3"

Re: Windows Event Excessive Logs

jotne — Wed, 05 Mar 2025 11:53:17 GMT

Just one line:

blacklist1 = EventCode="46[23]4" Message="Logon Type:\s+3"