thousands of security logs in event viewer


  1. Posts : 241
    Windows 10 Pro
       #1

    thousands of security logs in event viewer


    I went to the Event Viewer to check why my system shut down and won't turn on for a few minutes after the shut down. Then I noticed that under "Windows Logs" >"Security", I have more than 10,000 "Audit Success" logs. more than 10 per second.
    Is this normal?

    EventID are mostly 5379 and 4798.

    The Windows installation is clean, using the 20H2 Media Creation Tools from Microsoft website

    Thanks
    Last edited by mibaup; 22 Mar 2021 at 13:21.
      My Computer


  2. Posts : 7,457
    Windows 10 Home 20H2
       #2

    mibaup said:
    I have more than 10,000 "Audit Success" logs. more than 10 per second.
    I have 26,469.

    thousands of security logs in event viewer-audit-success.jpg
      My Computer


  3. Posts : 16,026
    Win 10 Pro 64-bit v1909 - Build 18363 Custom ISO Install
       #3

    Hello @mibaup,

    mibaup said:
    I went to the Event Viewer to check why my system shut down and won't turn on for a few minutes after the shut down. Then I noticed that under "Windows Logs" >"Security", I have more than 10,000 "Audit Success" logs. more than 10 per second.
    Is this normal?

    The Windows installation is clean, using the 20H2 Media Creation Tools from Microsoft website.

    Run the command below in a CMD Prompt to list the total entries for EACH log . . .
    Code:
    
    PowerShell Get-EventLog -List ^| Format-Table -AutoSize

    Example output . . .
    Code:
    
    Microsoft Windows [Version 6.0.6002]
    Copyright (c) 2006 Microsoft Corporation.  All rights reserved.
    
    C:\Windows\system32>PowerShell Get-EventLog -List ^| Format-Table -AutoSize
    
    Max(K) Retain OverflowAction    Entries Log
    ------ ------ --------------    ------- ---
    20,480      0 OverwriteAsNeeded     423 Application
       512      7 OverwriteOlder          0 CaptureLibLog
    20,480      0 OverwriteAsNeeded       0 HardwareEvents
    20,480      0 OverwriteAsNeeded       0 Key Management Service
    20,480      0 OverwriteAsNeeded      60 Security
    20,480      0 OverwriteAsNeeded     277 System
    15,360      0 OverwriteAsNeeded     891 Windows PowerShell

    You could then run it AGAIN after about 5 minutes to see if there is a VAST difference in the totals. This should hopefully highlight any unusually drastic operations taking place, if ANY.

    Just a thought.

    The command in PowerShell [ if you prefer ] is . . .
    Code:
    
    Get-EventLog -List | Format-Table -AutoSize

    I hope this helps.
      My Computer


  4. Posts : 241
    Windows 10 Pro
    Thread Starter
       #4

    it's weird, the CMD command doesn't show the security log number, it only shows the word "Security" but it's blank. The power shell however does show. And since I wrote the post, I got 1000+ more, and Event Viewer even added Exclamation mark next to the number. It shows: 13110(!) New events available

    EventID are mostly 5379 and 4798.


    Powershell output:
    Code:
    Max(K) Retain OverflowAction    Entries Log
    
    
    ------ ------ --------------    ------- ---
    
    
    20,480      0 OverwriteAsNeeded     551 Application
    
    
    20,480      0 OverwriteAsNeeded       0 HardwareEvents
    
    
       512      7 OverwriteOlder          0 Internet Explorer
    
    
    20,480      0 OverwriteAsNeeded       0 Key Management Service
    
    
    20,480      0 OverwriteAsNeeded  13,218 Security
    
    
    20,480      0 OverwriteAsNeeded   1,310 System
    
    
    15,360      0 OverwriteAsNeeded      31 Windows PowerShell
    - - - Updated - - -

    Matthew Wai said:
    I have 26,469.
    thousands of security logs in event viewer-audit-success.jpg
    Oh so I guess it's something normal?
      My Computer


  5. Posts : 1,614
    Windows 10 Home
       #5

    Paul Black and Snick have developed BATchfiles which can delete all Event logs everywhere and give a computer a fresh start. I have used their stuff, and such really works.
      My Computer


  6. Posts : 7,457
    Windows 10 Home 20H2
       #6

    mibaup said:
    Oh so I guess it's something normal?
    My Windows has been working normally since I clean installed 20H2.
    Nine hours ago, there were 26,469 events as shown in my post #2 above.
    At this moment, there are 26,390 events as shown in my screenshot below.

    thousands of security logs in event viewer-audit-success-26390.jpg

    I have not deleted anything manually in the past nine hours, so I believe Even Viewer has automatically deleted some old events. That is normal.
    覧覧覧覧覧覧覧覧覧覧覧覧覧覧覧覧覧覧覧
    After minutes, at this moment, there are 26,394 events, and the size is only 20.00 MB, which I won't care about.
      My Computer


  7. Posts : 1,595
    Windows 10 Professional
       #7

    Yea, I've always found those logs pretty strange. I've seen them numerous times in my Event Viewer as well.
    I currently have: 26,124
    of these logs.

    What is strange is that in General tab below for each of them, they show:
    • Special privileges assigned to new logon.
    • An account was successfully logged on.
    • Credential Manager credentials were read.
      My Computer


  8. Posts : 71
    Windows 10 Home Premium v21H2 64bit OS Build 19044.1706
       #8

    Event ID 5379


    Hi,
    I have found a way of reducing these numerous events in the Audit Success part of the event log. It is done by using the command Auditpol. It may not work on some versions of windows but if you type it into an administrative command prompt, you will soon find out. An error message obviously indicates it will not work but information on the command is what we are looking for. If anybody wants help on Auditpol and what I did, let me know. I have found it by spending a lot of time on line. I am no expert so all changes you may make are down to you. All I will say it has completely stopped Event ID 5379 for me with so far no obvious problems.
    The reason for doing this change is that I have been having random power resets, which I have pinned down to the MB. HWInfo showing CPU usage at 105% at startup when most of the resets occur. So anything to reduce the 400 to 500 events on start up with the obvious load on the cpu has to be considered.
      My Computer


 

  Related Discussions
Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

ゥ Designer Media Ltd
All times are GMT -5. The time now is 06:52.
Find Us




Windows 10 Forums