Filling up the Windows 2003 security audit log - secWinAD

[Former Member]

I am getting about 25 logon/logoff messages (mostly event id 552) every second logged to the Windows 2003 security log. The user in the message is the service account we use for Active Directory integration. We only have about 25 users logged in. Why am I seeing so much activity? The 300 meg log is showing less than 24 hours of activity before it is being overwritten. We are on BOE XI R2 SP3 using WebSphere WAS.

[Former Member · Accepted solution]

Hi Kristof,

Thanks for your reply.

> - Is tracing enabled...

No, I verified that none of the service command lines include "-trace"

> ...Kerberos, check the config files...

"debug=true;" is NOT present in our bscLogin.conf file

> ...log Kerberos events...

We have had logging turned before. It is controlled by a Windows registry setting: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters\LogLevel

We are not logging Kerberos events.

We did do some trouble shooting with Kerberos awhile ago. I'm thinking that maybe some debug setting somewhere didn't get reset, but I'm not finding anything.

Thanks again for your reply,

Nick

[BasicTek · Accepted solution]

I'd suggest contacting IBM to verify you have their latest version of the java SDK (1.5 or above is recommended)

using udp_preference_limit =1 in the libdefaults section of the krb5.ini to force TCP

And if those don't work then open a message with support to investigate.

Regards,

Tim

[Former Member]

I am seeing the CMS.exe service continually running at 10 - 15% of the CPU. Is anybody else seeing this?

[Former Member]

Hello Nick,

I haven't come in contact with a WebSphere deployment yet, but perhaps you could check the following:

- Is tracing enabled on the CMC (or any other) service? You should look for a "-trace" in the service's commandline

- If you're using kerberos, check the config files to see if debugging is not enabled

- The BO technical paper detailing the setup of Windows AD / SSO mentions the possibility to log Kerberos events to the eventlog. Are you sure this hasn't been enabled?

Hope this helps.

Kind regards,

Kristof