network logon again

	Forums Register Login My Profile Inbox Address Book My Subscription My Forums Member List Search FAQ Ticket List Log Out

network logon again

Logged in as: Guest

Users viewing this topic: none

Printable Version

All Forums >> [Networking & Security] >> GFI EventsManager >> network logon again

Page: [1]

Message

<< Older Topic Newer Topic >>

network logon again - 6.Dec.2006 9:29:51 AM

matthies

Posts: 3
Score: 0
Joined: 6.Dec.2006
Status: offline

Hi.

The Eventsmanagers scan creates thausands of logon/logoff events on one of our domain controller. To be precise we can see sequences of 680,576,540,538 events (hundreds of them inside one second) created by the user the EVentsManager service is running with while the scan is running. The scan is scheduled every 15 minutes. We can filter these events but it's odd when 90% of the scanned events are created by the tool itself.

Configuration error??

Post #: 1

RE: network logon again - 6.Dec.2006 11:12:14 AM

Arielle

Posts: 295
Score: 0
Joined: 15.Sep.2006
Status: offline

Hi,

EventsManager needs to access the machines just as every user does. These events are logged because that is the way that the Microsoft logging system works. Unfortunately logging of these events cannot be avoided.

That is the purpose of noise reduction rules, so events that you don't need will be ignored.

_____________________________

Arielle Bonnici

GFI Blog: http://www.gfi.com/blog � Follow Us (Twitter): http://www.twitter.com/gfisoftware � Watch Us (YouTube): http://www.youtube.com/gfisoftware

(in reply to matthies)

Post #: 2