Security log on this system is full

Topic

New Reply

Started getting this message at logon.
Found Event Viewer for security log filled over the past 7 days.
Shows Event ID 861 for Failure of mostly svchost.exe and sass.exe as “The Windows Firewall has detected an application listening for incoming traffic.”

I have no performance problems and don’t believe this is a security problem.

I’ve cleared the log and it is filling quickly.

Suggestions on fixing the high numbers of failure reports?

Reply | Quote

Replies

TCPView for Windows v2.54 or Process explorer may help identify the process responsible.

More Info
Troubleshooting Windows Firewall in Microsoft Windows XP Service Pack 2
Event ID 861 Source Security
Windows-Expert.com
Event ID: 861 – The Windows Firewall has detected an application listening for incoming traffic

Reply | Quote

Process Explorer is good for giving some insight into what is going on, but so far there has been no indication where the failures are originating.

Resorting to Help-Understanding Event Viewer, I find
“By default, security logging is turned off. You can use Group Policy to enable security logging.”
So the next question is
Why is default to have security logging turned off?

Reply | Quote