https://community.hpe.com/t5/server-management-systems/foundation-agent-hammering-security-event-log/m-p/3337747#M4434 Does anyone know why the foundation management agent is causing an inordinate amount of security log entries (60-70 per second). Specifically registry and file system access entries. What keys is it checking and is there any way to manage the objects the foundation agent is checking? Wed, 21 Jul 2004 12:35:20 GMT Nathan Scholl 2004-07-21T12:35:20Z https://community.hpe.com/t5/server-management-systems/foundation-agent-hammering-security-event-log/m-p/3337747#M4434 Does anyone know why the foundation management agent is causing an inordinate amount of security log entries (60-70 per second). Specifically registry and file system access entries. What keys is it checking and is there any way to manage the objects the foundation agent is checking? Wed, 21 Jul 2004 12:35:20 GMT https://community.hpe.com/t5/server-management-systems/foundation-agent-hammering-security-event-log/m-p/3337747#M4434 Nathan Scholl 2004-07-21T12:35:20Z https://community.hpe.com/t5/server-management-systems/foundation-agent-hammering-security-event-log/m-p/3337748#M4435 I've never run into anything like that. Can you be more specific about things like the OS and the exact messages you're seeing (a screen shot could be helpful). Wed, 21 Jul 2004 13:54:27 GMT https://community.hpe.com/t5/server-management-systems/foundation-agent-hammering-security-event-log/m-p/3337748#M4435 David Claypool 2004-07-21T13:54:27Z https://community.hpe.com/t5/server-management-systems/foundation-agent-hammering-security-event-log/m-p/3337749#M4436 Thanks for responding...<BR />The box is a Windows 2000 Advanced Server with Audit Object Access GPO enabled to success. I know it is the foundation agent because the sec events stop when I shut the agent down. Consequently, the sec events start rapidly filling when I turn the service back on. Wed, 21 Jul 2004 16:42:50 GMT https://community.hpe.com/t5/server-management-systems/foundation-agent-hammering-security-event-log/m-p/3337749#M4436 Nathan Scholl 2004-07-21T16:42:50Z https://community.hpe.com/t5/server-management-systems/foundation-agent-hammering-security-event-log/m-p/3337750#M4437 Okay, I just set the local policy on a DL360G3 / W2KSP4 / PSP7.0 system and nothing immediately popped into the security log. I'll check in the morning and let you know.<BR /><BR />Is there any other data in the event detail that can give us a clue? Wed, 21 Jul 2004 17:36:19 GMT https://community.hpe.com/t5/server-management-systems/foundation-agent-hammering-security-event-log/m-p/3337750#M4437 David Claypool 2004-07-21T17:36:19Z https://community.hpe.com/t5/server-management-systems/foundation-agent-hammering-security-event-log/m-p/3337751#M4438 No, I still don't have any of the events you describe. Do you have any other information you could share so I can consult with the developers? Thu, 22 Jul 2004 13:53:18 GMT https://community.hpe.com/t5/server-management-systems/foundation-agent-hammering-security-event-log/m-p/3337751#M4438 David Claypool 2004-07-22T13:53:18Z https://community.hpe.com/t5/server-management-systems/foundation-agent-hammering-security-event-log/m-p/3337752#M4439 I am trying to reproduce in a seperate environment. I will keep posting when I find out more. Thanks for the support Fri, 23 Jul 2004 13:34:53 GMT https://community.hpe.com/t5/server-management-systems/foundation-agent-hammering-security-event-log/m-p/3337752#M4439 Nathan Scholl 2004-07-23T13:34:53Z