Getting Data In

enormous amounts of EventCode=4674

saschar
New Member

Hello everybody,

i have a server that produces per minute 13000 security logs with the EventCode=4674 (An operation was attempted on a privileged object).
what is the problem and how can i fix it?

Tags (1)
0 Karma

yannK
Splunk Employee
Splunk Employee

You can filter those EventCodes out

see Additional method to filter since Splunk 6.*
http://answers.splunk.com/answers/116817/filter-wineventlog-events-based-on-the-eventcodes

mykol_j
Communicator

(how do I give negative Karma?)

 

0 Karma

sbrant_splunk
Splunk Employee
Splunk Employee

One option is to adjust your object-level auditing in Windows to a more appropriate level, if this is too verbose.

kristian_kolb
Ultra Champion

That option sure is the correct way to cure the symptom - and maybe also the disease. Even if there are a looot of events on a windows box, there might be just about nothing going on... 🙂

/k

0 Karma

sbrant_splunk
Splunk Employee
Splunk Employee

touche. I did say ONE option though 😉

0 Karma

kristian_kolb
Ultra Champion

mhmm, and perhaps figure out WHICH object, WHAT operation and WHO did (attempt) it. Just to be sure, mkay?

Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...