Getting Data In

splunk-optimize.exe WIndows Security Events

jheilman
Explorer

I have a test Windows forwarder set up that is generating over 22,000 events relating to the splunk-optimize.exe process in the Windows Security Event Log. I've temporarily implemented a filter that forwards Event ID 592 and 593 to nullQueue, but ideally we would want to index that data. 22k events per 24 hours per splunk Windows instance seems a bit expensive though.

Is it normal for splunk-optimize to run this often or generate this many events?

Setup Info:

The splunk indexer is set up on a Linux machine. The forwarder is running on Windows 2k3 Server (32-bit) in a virtual machine with two 2.66GHz processors (Intel Xeon) and 1GB of RAM. It's configured as a full forwarder.

1 Solution

gkanapathy
Splunk Employee
Splunk Employee

This is normal. If you're choosing to turn your Windows auditing to record every process launch and termination, then on many server applications you should expect to see many such events. This corresponds to only about one process launch and exit every 7 seconds or so.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

This is normal. If you're choosing to turn your Windows auditing to record every process launch and termination, then on many server applications you should expect to see many such events. This corresponds to only about one process launch and exit every 7 seconds or so.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...