Foundation agent hammering security event log

[Nathan Scholl]

Does anyone know why the foundation management agent is causing an inordinate amount of security log entries (60-70 per second). Specifically registry and file system access entries. What keys is it checking and is there any way to manage the objects the foundation agent is checking?

[David Claypool]

I've never run into anything like that. Can you be more specific about things like the OS and the exact messages you're seeing (a screen shot could be helpful).

[Nathan Scholl]

Thanks for responding...
The box is a Windows 2000 Advanced Server with Audit Object Access GPO enabled to success. I know it is the foundation agent because the sec events stop when I shut the agent down. Consequently, the sec events start rapidly filling when I turn the service back on.

[David Claypool]

Okay, I just set the local policy on a DL360G3 / W2KSP4 / PSP7.0 system and nothing immediately popped into the security log. I'll check in the morning and let you know.

Is there any other data in the event detail that can give us a clue?

[David Claypool]

No, I still don't have any of the events you describe. Do you have any other information you could share so I can consult with the developers?

[Nathan Scholl]

I am trying to reproduce in a seperate environment. I will keep posting when I find out more. Thanks for the support