12

Our event viewer shows two information-level messages that we want to omit from the event logs:

  1. When a user fails authentication (Event code: 4006 Event message: Membership credential verification failed.)
  2. When forms authentication has expired and the user navigates to the default page (Event code: 4005 Event message: Forms authentication failed for the request. Reason: The ticket supplied has expired.)

Researching how to exclude these types of messages has led me to understand that if I include the following in my web.config file, these messages won't show up. When I test this, I see that is indeed the case.

<healthMonitoring>
    <rules>
        <clear />
        <add name="All Errors Default" eventName="All Errors" provider="EventLogProvider" profile="Default" minInstances="1" maxLimit="Infinite" minInterval="00:01:00" custom=""/>
    </rules>
</healthMonitoring>

In other words, I omit this from the default web.config:

<add name="Failure Audits Default" eventName="Failure Audits" provider="EventLogProvider" profile="Default" minInstances="1" maxLimit="Infinite" minInterval="00:01:00" custom=""/>

My question is: what else could I potentially be excluding the event log by removing this node? And if there are other potential repercussions, is there another or a better way to exclude just those two types of error logs that I mentioned above?

Thanks in advance!

user1422348
  • 345
  • 1
  • 7
  • 23

1 Answers1

1

I really wish I could comment! Have you tried setting startEventCode and endEventCode params in your event mappings for "Failure Audits" event;

P.N: I haven't had a chance to test this this myself, but hope this could be of some help to you

Reference: https://msdn.microsoft.com/en-us/library/yc5yk01w(v=vs.85).aspx

madasu naga
  • 154
  • 8
  • Do you know how I would go about omitting just codes 4005 and 4006? – user1422348 Aug 18 '16 at 22:31
  • Okay I basically set the startEventCode at 4007 and ending at 4011, which I think is the range for the Failure Audits based on http://forums.asp.net/post/4799205.aspx and https://msdn.microsoft.com/en-us/library/ms998325.aspx. Thank you for pointing me in the right direction. – user1422348 Aug 18 '16 at 23:18
  • You're welcome and appreciate it on letting us know that it worked :) – madasu naga Aug 19 '16 at 14:03