Windows logs : security full of 4904 and 4905

[sogapex]

Hi,

I just open a case = 05993634

When i look at my windows event log (the "security" one), I can see a lot (a "awful" lot) of events 4904 and 4905 referring to "C:\Program Files\Veeam\Backup365\Veeam.Archiver.Proxy.exe"
It seems I can get more than 30000 events in less than 1 hour !

This is a windows server 2019 with Veeam B&R v12 and Veeam VB365 v7
I restarted the PC and the "flow" stops.
But as soon as I launch Veeam VB365, it appears again (246 events from 09:07:31 to 09:08:07)

Let's see if we are alone in this case and what is the reason

[Mildur]

Hi Sogapex

I see the same in my lab. Let's see what support will find out.

Best,
Fabian

[sogapex]

Hi Fabian,
by the moment, we found nothing interesting.
Only thing I can suppose from this webpage (https://www.ultimatewindowssecurity.com ... =chapter11) =
"C:\Program Files\Veeam\Backup365\Veeam.Archiver.Service.exe" is calling the "AuthzRegisterSecurityEventSource" function more than 100 times per minutes (=> more than 200 events per minutes generated in the log), only when the Veeam VB365 console is opened.
regards,
Michel

[sogapex]

Hi, a little more "data" on the subject :
for testing purpose I did a "config" reset and rollback friday => the backup job was not longer processing our "licenced" mailboxes this weekend
so, today, I repaired my veeam 365 config :
I launched Veeam 365 at 6h58 and quit the console after the job was finished => at 8h35
The console was opened during 97 minutes
There are 25242 events in the security log during this timeframe (99% from Veeam365).
It means I have no history in the security log (max = about 33000 events) because in less than a week, Veeam365 can "flood" it.
Temporary solution = do not open the Veeam365 console and increase the log size to accomodate far more than 33000 events.

I also installed a new Windows server 2019 std, without internet connection. (new test VM)
Then I only install Veeam365 => at the first launch of the console (i didn't even close the first popup) => the audit log is "flooded"

[sogapex]

Good news, this is already fixed.
Version 7.0.0.3007 has gotten ride of this little "annoyance"
https://www.veeam.com/kb4425#P20230421%20(7.0.0.3007)
Good job Veeam

[Mildur]

Good to hear.

Thank you for the update
Fabian