thousands of security logs in event viewer

mibaup · 22 Mar 2021

I went to the Event Viewer to check why my system shut down and won't turn on for a few minutes after the shut down. Then I noticed that under "Windows Logs" >"Security", I have more than 10,000 "Audit Success" logs. more than 10 per second.
Is this normal?

EventID are mostly 5379 and 4798.

The Windows installation is clean, using the 20H2 Media Creation Tools from Microsoft website

Thanks

Matthew Wai · 22 Mar 2021

mibaup said:

I have more than 10,000 "Audit Success" logs. more than 10 per second.

I have 26,469.

thousands of security logs in event viewer-audit-success.jpg

Paul Black · 22 Mar 2021

Hello @mibaup,

mibaup said:

I went to the Event Viewer to check why my system shut down and won't turn on for a few minutes after the shut down. Then I noticed that under "Windows Logs" >"Security", I have more than 10,000 "Audit Success" logs. more than 10 per second.
Is this normal?

The Windows installation is clean, using the 20H2 Media Creation Tools from Microsoft website.

Run the command below in a CMD Prompt to list the total entries for EACH log . . .

Code:


PowerShell Get-EventLog -List ^| Format-Table -AutoSize

Example output . . .

Code:


Microsoft Windows [Version 6.0.6002]
Copyright (c) 2006 Microsoft Corporation.  All rights reserved.

C:\Windows\system32>PowerShell Get-EventLog -List ^| Format-Table -AutoSize

Max(K) Retain OverflowAction    Entries Log
------ ------ --------------    ------- ---
20,480      0 OverwriteAsNeeded     423 Application
   512      7 OverwriteOlder          0 CaptureLibLog
20,480      0 OverwriteAsNeeded       0 HardwareEvents
20,480      0 OverwriteAsNeeded       0 Key Management Service
20,480      0 OverwriteAsNeeded      60 Security
20,480      0 OverwriteAsNeeded     277 System
15,360      0 OverwriteAsNeeded     891 Windows PowerShell

You could then run it AGAIN after about 5 minutes to see if there is a VAST difference in the totals. This should hopefully highlight any unusually drastic operations taking place, if ANY.

Just a thought.

The command in PowerShell [ if you prefer ] is . . .

Code:


Get-EventLog -List | Format-Table -AutoSize

I hope this helps.

mibaup · 22 Mar 2021

it's weird, the CMD command doesn't show the security log number, it only shows the word "Security" but it's blank. The power shell however does show. And since I wrote the post, I got 1000+ more, and Event Viewer even added Exclamation mark next to the number. It shows: 13110(!) New events available

EventID are mostly 5379 and 4798.

Powershell output:

Code:

Max(K) Retain OverflowAction    Entries Log


------ ------ --------------    ------- ---


20,480      0 OverwriteAsNeeded     551 Application


20,480      0 OverwriteAsNeeded       0 HardwareEvents


   512      7 OverwriteOlder          0 Internet Explorer


20,480      0 OverwriteAsNeeded       0 Key Management Service


20,480      0 OverwriteAsNeeded  13,218 Security


20,480      0 OverwriteAsNeeded   1,310 System


15,360      0 OverwriteAsNeeded      31 Windows PowerShell

- - - Updated - - -

Matthew Wai said:

I have 26,469.

Oh so I guess it's something normal?

RolandJS · 22 Mar 2021

Paul Black and Snick have developed BATchfiles which can delete all Event logs everywhere and give a computer a fresh start. I have used their stuff, and such really works.

Matthew Wai · 22 Mar 2021

mibaup said:

Oh so I guess it's something normal?

My Windows has been working normally since I clean installed 20H2.
Nine hours ago, there were 26,469 events as shown in my post #2 above.
At this moment, there are 26,390 events as shown in my screenshot below.

thousands of security logs in event viewer-audit-success-26390.jpg

I have not deleted anything manually in the past nine hours, so I believe Even Viewer has automatically deleted some old events. That is normal.
——————————————————————————————————————
After minutes, at this moment, there are 26,394 events, and the size is only 20.00 MB, which I won't care about.

pepanee · 22 Mar 2021

Yea, I've always found those logs pretty strange. I've seen them numerous times in my Event Viewer as well.
I currently have: 26,124
of these logs.

What is strange is that in General tab below for each of them, they show:
• Special privileges assigned to new logon.
• An account was successfully logged on.
• Credential Manager credentials were read.

parsonm · 03 Mar 2022

Hi,
I have found a way of reducing these numerous events in the Audit Success part of the event log. It is done by using the command Auditpol. It may not work on some versions of windows but if you type it into an administrative command prompt, you will soon find out. An error message obviously indicates it will not work but information on the command is what we are looking for. If anybody wants help on Auditpol and what I did, let me know. I have found it by spending a lot of time on line. I am no expert so all changes you may make are down to you. All I will say it has completely stopped Event ID 5379 for me with so far no obvious problems.
The reason for doing this change is that I have been having random power resets, which I have pinned down to the MB. HWInfo showing CPU usage at 105% at startup when most of the resets occur. So anything to reduce the 400 to 500 events on start up with the obvious load on the cpu has to be considered.