Getting Data In

What might be the reason for excessive logs in Windows event?

omprakash9998
Path Finder

I have around 800 users in my environment and the count of 4624 and 4634 is around 80,000 for the last 15 minutes. What might be the reason.

Thank you,

Labels (1)
Tags (1)
0 Karma
1 Solution

nickhills
Ultra Champion

Pro Tip:

Decide which login events you really care about (maybe check with security team if applicable)
However, most of your 4624s will probably be LoginType 3 - Which is network access - you may see this every time you access anything on the network, even if you don't actually open/edit a file etc.

You may decide that you only care about:
LoginType 2 - Interactive (ie with a keyboard attached to the system)
Type7 - Unlocking a workstation, or
Type 10 - remote Interactive (ie RDP/remote access etc)

you could blacklist types 1,3,4,5,6,8,9 and reduce your login events to a fraction of what you have right now, whilst preserving the most important/relevant ones.

blacklist = EventCode="4624" Message="LogonType=(1|3|4|5|6|8|9)"

or to just drop type 3
blacklist1 = EventCode="4624" Message="LogonType=3"

If my comment helps, please give it a thumbs up!

View solution in original post

nickhills
Ultra Champion

Pro Tip:

Decide which login events you really care about (maybe check with security team if applicable)
However, most of your 4624s will probably be LoginType 3 - Which is network access - you may see this every time you access anything on the network, even if you don't actually open/edit a file etc.

You may decide that you only care about:
LoginType 2 - Interactive (ie with a keyboard attached to the system)
Type7 - Unlocking a workstation, or
Type 10 - remote Interactive (ie RDP/remote access etc)

you could blacklist types 1,3,4,5,6,8,9 and reduce your login events to a fraction of what you have right now, whilst preserving the most important/relevant ones.

blacklist = EventCode="4624" Message="LogonType=(1|3|4|5|6|8|9)"

or to just drop type 3
blacklist1 = EventCode="4624" Message="LogonType=3"

If my comment helps, please give it a thumbs up!

avery2007
Explorer

Has anyone inserted this in the inputs.conf that has the appropriate regex to make this work?

0 Karma

96nick
Communicator

While years late, hopefully this helps someone out in the future. This works:

blacklist1 = EventCode="4624" Message="Logon Type:\s+3"
blacklist2 = EventCode="4634" Message="Logon Type:\s+3"

 

jotne
Builder

Just one line:

blacklist1 = EventCode="46[23]4" Message="Logon Type:\s+3"

0 Karma

yannK
Splunk Employee
Splunk Employee

if your problem is too much verbose events from wineventlog, causing higher license usage
you can a use a blacklist filter on the splunk inputs.conf to exclude them from the monitoring.

see wineventlog whitelist/blacklist settings
http://docs.splunk.com/Documentation/Splunk/7.0.1/Data/MonitorWindowseventlogdata

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...