1

I was seeing a lot of entries in the eventlog:

The Windows Filtering Platform has permitted a connection.
Application Information:
    Process ID:                4
    Application Name:          System
Network Information:
    Direction:                  Inbound
    Source Address:             10.xxx.xxx.xxx
    Source Port:                80
    Destination Address:        10.xxx.xxx.xxx
    Destination Port:           31773
    Protocol:                   6
Filter Information:
    Filter Run-Time ID:         67903
    Layer Name:                 Receive/Accept
    Layer Run-Time ID:          44

We have a loadbalancer which checks every second to see if the application is still running (a health check). The logs contain large amounts of this kind of entries, which makes the Event Viewer slow and it's difficult to find the more interesting logs.

How do I make sure these messages don't end up in the event logs?

2
  • @joeqwerty I rephrased it into a question, maybe you could remove the downvote and your comment (so it will be clear), thanks for the nudge to follow the appropiate guidlines!
    – Jaap
    Oct 1, 2012 at 14:46
  • Fair enough. done.
    – joeqwerty
    Oct 1, 2012 at 15:27

2 Answers 2

1

You can turn off this type of logs with the following command line statement:

auditpol /set /subcategory:"Filtering Platform Connection" /success:disable /failure:enable

Found it here:
http://www.cupfighter.net/index.php/2009/10/get-rid-of-event-id-5156-the-windows-filtering-platform-has-allowed-a-connection/

1

Yes you can get rid of many ways ..

Source: http://www.morgantechspace.com/2013/09/event-id-5156-filtering-platform.html

Solution 1: If you would like to get rid of this Filtering Platform Connection event 5156 then you need to run the following commands in an elevated command prompt (Run As Administrator):

Auditpol /set /subcategory:"Filtering Platform Connection" /Success:disable

Then update gpo by this command

gpupdate /force

Solution 2 :

You can also disable Filtering Platform Connection in Advanced Audit Policy Configuration of Local Security Policy.

1. Press the key Windows + R
2. Type command secpol.msc, click OK
3. Then go to the node Advanced Audit Policy Configuration->Object Access.
4. Check the audit setting **Audit Filtering Platform Connection** If it is configured as Success, you can   revert it Not Configured and Apply the setting.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .