Re: Security Event log

From: Mike T. (anonymous_at_discussions.microsoft.com)
Date: 03/18/04 

Date: Thu, 18 Mar 2004 08:44:01 -0800

Roger,

Thanks alot for the help. I found what was causing all of
the logging - Audit System Events was turned on for both
success and failure.

Once I turned that off - all my problems went away!

Regards,

Mike

>-----Original Message-----
>On W2k this issue will come up if the event logs are
>configured the same. In the local security policy (or in
>a GPO if you have AD) you can configure the maximum
>size for the three main event logs, and you can also state
>the policy to follow when the log is full. One of the
>settings for this last, to overwrite as needed, will never
>result in a full log.
>What you should do is determine why their event log is
>filling up. What is being logged so much.
>If you increase the event log to say 16 meg and to
overwrite
>as needed or overwrite older that a week or two, your
issue
>will go away unless there is something being logged with
>high frequency that you need to resolve.
>
>--
>Roger Abell
>Microsoft MVP (Windows Server System: Security)
>MCSE (W2k3,W2k,Nt4) MCDBA
>"Mike T." <anonymous@discussions.microsoft.com> wrote in
message
>news:f20c01c40c39$efaeb550$a101280a@phx.gbl...
>> I've got a few users that use XP and on a weekly basis
>> their Security Event log fills up and won't allow them
to
>> login until after I clear it logging in as
administrator.
>>
>> All users are in the Power User group. When I've gone
>> into the properties of the Security Log I am unable to
>> make any changes to the properties due to the user not
>> being in the Admin group or an Administrator.
>>
>> How do I prevent this log file from continually filling
up
>> and preventing the user from logging in. On W2K pc's
this
>> issue does not come up.
>
>
>.
>

Relevant Pages

  • Permission denied writing to event log from global.asa after night
    ... The applcation logs to the Event Log when the user performs specific actions ... What we did then was to change the Security Identifier of the Event Log ... happened during the night I can see a message "Security policy in the Group ... when logging works again, to do a gpupdate /force but logging continues to ...
    (microsoft.public.inetserver.iis.security)
  • Re: Logging!!?
    ... > I am used to use logging into a file with Java but I see many in .NET use ... > Can you tell me if anybody cares about logging and what is the strategy ... you might want to use a database. ... The Event log allows you to filter/sort the records on ...
    (microsoft.public.dotnet.languages.csharp)
  • Re: Windows Service in C#
    ... Depending on what level of logging you need log4net or the Enterprise Library logging block may be of use. ... I'd start by checking the event log in the application section on the machine where the errors are occuring at just to make sure something hasn't already been logged. ... In this way you can use the debugger against the service in the same way as if you were debugging a standard windows executable. ... This works, but a drawback of this method is that it doesn't allow you to debug the process from the start, so you can miss events you need to see. ...
    (microsoft.public.dotnet.languages.csharp)
  • Re: GP NOt Working on One XP Workstation
    ... You probably need to enable logging and try to find any ... possibly related messages in the event log of that machine. ... XP that walks you through enabling logging by policy ...
    (microsoft.public.windows.group_policy)
  • Re: Can you Audit logouts??
    ... > I have auditing for logins/logouts turned on. ... > when people are logging in and logging out? ... > see when user John Doe logged out last week one night if ... The event log is painful to go ...
    (microsoft.public.win2000.security)
Quantcast