Getting Data In

What might be the reason for excessive logs in Windows event?

omprakash9998
Path Finder

I have around 800 users in my environment and the count of 4624 and 4634 is around 80,000 for the last 15 minutes. What might be the reason.

Thank you,

Labels (1)
Tags (1)
0 Karma
1 Solution

nickhills
Ultra Champion

Pro Tip:

Decide which login events you really care about (maybe check with security team if applicable)
However, most of your 4624s will probably be LoginType 3 - Which is network access - you may see this every time you access anything on the network, even if you don't actually open/edit a file etc.

You may decide that you only care about:
LoginType 2 - Interactive (ie with a keyboard attached to the system)
Type7 - Unlocking a workstation, or
Type 10 - remote Interactive (ie RDP/remote access etc)

you could blacklist types 1,3,4,5,6,8,9 and reduce your login events to a fraction of what you have right now, whilst preserving the most important/relevant ones.

blacklist = EventCode="4624" Message="LogonType=(1|3|4|5|6|8|9)"

or to just drop type 3
blacklist1 = EventCode="4624" Message="LogonType=3"

If my comment helps, please give it a thumbs up!

View solution in original post

nickhills
Ultra Champion

Pro Tip:

Decide which login events you really care about (maybe check with security team if applicable)
However, most of your 4624s will probably be LoginType 3 - Which is network access - you may see this every time you access anything on the network, even if you don't actually open/edit a file etc.

You may decide that you only care about:
LoginType 2 - Interactive (ie with a keyboard attached to the system)
Type7 - Unlocking a workstation, or
Type 10 - remote Interactive (ie RDP/remote access etc)

you could blacklist types 1,3,4,5,6,8,9 and reduce your login events to a fraction of what you have right now, whilst preserving the most important/relevant ones.

blacklist = EventCode="4624" Message="LogonType=(1|3|4|5|6|8|9)"

or to just drop type 3
blacklist1 = EventCode="4624" Message="LogonType=3"

If my comment helps, please give it a thumbs up!

avery2007
Explorer

Has anyone inserted this in the inputs.conf that has the appropriate regex to make this work?

0 Karma

96nick
Communicator

While years late, hopefully this helps someone out in the future. This works:

blacklist1 = EventCode="4624" Message="Logon Type:\s+3"
blacklist2 = EventCode="4634" Message="Logon Type:\s+3"

 

yannK
Splunk Employee
Splunk Employee

if your problem is too much verbose events from wineventlog, causing higher license usage
you can a use a blacklist filter on the splunk inputs.conf to exclude them from the monitoring.

see wineventlog whitelist/blacklist settings
http://docs.splunk.com/Documentation/Splunk/7.0.1/Data/MonitorWindowseventlogdata

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...