Event Logs

[teknovision]

Hi there!

My SBS 2003 (with 6 users on domain) has produced some 700 or so Security Event logs in the space of 20 minutes - there were a 130'000 over the space of two weeks before I cleared. I'm a bit concerned, should I be, is this normal?

Many thanks,

Philippe

 

[tfg13]

What are the event numbers? If they are 560 errors, I have found that disabling the indexing service calms down the entries. If it's another number, let us know so we can assist.

 

[teknovision]

Thanks tfg13, I get the following Event IDs; 540 (53'000 times), 538 (53'000 times) and 576 (51'000 times). All of this in the space of 36 hours for only 6 users!! Many thanks for any help?

 

[tfg13]

What levels of auditing do you currently have set on the domain? Do you audit everything, or just certain things?