Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Reduce the number of logins (Security logs filling up)

Hey all, I have removed a particular node and readded, not applying any templates, but still there are two logins every minute. I changed the Orion Polling status to the max (32767) and still see this. Where is the setting to fix this?

Only thing here I found was this but the guy suggested turning off Success audits which is not a good idea. WMI polling fills up Windows security log

Find more posts tagged with

event logs

wmi_polling

WMI

Accepted answers

aLTeReGo

You could use the Agent which polls the system locally instead of remotely. Alternatively you could switch the polling method to SNMP since SNMP isn't audited by Windows.

All comments

aLTeReGo

You could use the Agent which polls the system locally instead of remotely. Alternatively you could switch the polling method to SNMP since SNMP isn't audited by Windows.

renegadenomad_x

SNMP will not report on say Active Directory for example. Now the agent sounds like a winner, and Id like to know how but the entire infrastructure suffers from this. There must be a way to trim this back, but how?

aLTeReGo

Many people choose not to audit success events, since they produce a lot of noise. If that is required in your organization then I would recommend a log aggregation solution like Log & Event Manager which will allow you to sift through the sea of events with ease, utilize the optional agent, or use a polling method that doesn't generate audit events such as SNMP. Unfortunately your options are fairly limited since Windows Auditing is pretty much an all or nothing affair. It cannot be tweaked to exclude specific event sources like "Don't log logins from my monitoring solution".

renegadenomad_x

No not tweak in Windows, tweak in the SAM. Even with only monitoring the C drive and CPU the SAM account logs in every minute. The triggers are set to 10 minutes, so I should only see a login every ten minutes. Successful logins can be beneficial for troubleshooting, so I am not turning them off.