Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I was seeing a lot of entries in the eventlog:

The Windows Filtering Platform has permitted a connection.
Application Information:
    Process ID:                4
    Application Name:          System
Network Information:
    Direction:                  Inbound
    Source Address:             10.xxx.xxx.xxx
    Source Port:                80
    Destination Address:        10.xxx.xxx.xxx
    Destination Port:           31773
    Protocol:                   6
Filter Information:
    Filter Run-Time ID:         67903
    Layer Name:                 Receive/Accept
    Layer Run-Time ID:          44

We have a loadbalancer which checks every second to see if the application is still running (a health check). The logs contain large amounts of this kind of entries, which makes the Event Viewer slow and it's difficult to find the more interesting logs.

How do I make sure these messages don't end up in the event logs?

share|improve this question
    
@joeqwerty I rephrased it into a question, maybe you could remove the downvote and your comment (so it will be clear), thanks for the nudge to follow the appropiate guidlines! –  Jaap Oct 1 '12 at 14:46
    
Fair enough. done. –  joeqwerty Oct 1 '12 at 15:27

2 Answers 2

Yes you can get rid of many ways ..

Source: http://www.morgantechspace.com/2013/09/event-id-5156-filtering-platform.html

Solution 1: If you would like to get rid of this Filtering Platform Connection event 5156 then you need to run the following commands in an elevated command prompt (Run As Administrator):

Auditpol /set /subcategory:"Filtering Platform Connection" /Success:disable

Then update gpo by this command

gpupdate /force

Solution 2 :

You can also disable Filtering Platform Connection in Advanced Audit Policy Configuration of Local Security Policy.

1. Press the key Windows + R
2. Type command secpol.msc, click OK
3. Then go to the node Advanced Audit Policy Configuration->Object Access.
4. Check the audit setting **Audit Filtering Platform Connection** If it is configured as Success, you can   revert it Not Configured and Apply the setting.
share|improve this answer
up vote 1 down vote accepted

You can turn off this type of logs with the following command line statement:

auditpol /set /subcategory:"Filtering Platform Connection" /success:disable /failure:enable

Found it here:
http://www.cupfighter.net/index.php/2009/10/get-rid-of-event-id-5156-the-windows-filtering-platform-has-allowed-a-connection/

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.