splunk-optimize.exe WIndows Security Events

[jheilman]

I have a test Windows forwarder set up that is generating over 22,000 events relating to the splunk-optimize.exe process in the Windows Security Event Log. I've temporarily implemented a filter that forwards Event ID 592 and 593 to nullQueue, but ideally we would want to index that data. 22k events per 24 hours per splunk Windows instance seems a bit expensive though.

Is it normal for splunk-optimize to run this often or generate this many events?

Setup Info:

The splunk indexer is set up on a Linux machine. The forwarder is running on Windows 2k3 Server (32-bit) in a virtual machine with two 2.66GHz processors (Intel Xeon) and 1GB of RAM. It's configured as a full forwarder.

[gkanapathy · Accepted solution]

This is normal. If you're choosing to turn your Windows auditing to record every process launch and termination, then on many server applications you should expect to see many such events. This corresponds to only about one process launch and exit every 7 seconds or so.