-1

I'm tasked with the monitoring and analysis of variious logs via our SIEM solution; LogRhythm.

I noticed a few weeks back that we had large volumes of this event originating from all of our domain controllers. The log data is as follows:

EventID: 521

Event Data: unable to log events to the security log

Status code: 0x80000005

Value of CrashonAuditFail: 0

Number of failed audits: 1

I've ensured that all domain controllers have sufficient disk space to write to the log & that the logs are configured to overwrite the oldest logs first. Servers have been bounced in the last few days but the issue remains.

I have read some suggestions about renaming the security event and restarting the machine so that a new event file is created but I can't believe that the event file has become corrupt on all domain controllers.

It's also worth noting that all of the impacted domain controllers are in fact writing other events to the security event log!

We are getting ~61.34k of these events a day.

Any pointers would be massively appreciated.

Improve this question
4
  • You left out an important detail. What is the "Source" of the EventID?
    – Colyn1337
    Dec 2, 2015 at 14:41
  • @Colyn1337 Sorry if I was not clear - the source is the security event log of all of our domain controllers.
    – JLPH
    Dec 2, 2015 at 14:44
  • How many DC's? Are they physical, virtual, mix? Are they connected to the same storage device? Are they in separate physical locations? Install any new log management software or backup software? Anyone do an intrusion detection scan?
    – Colyn1337
    Dec 2, 2015 at 14:48
  • @Colyn1337 Good questions - 19 DC's in total and all virtual. A handful will have the same storage device but the rest will have their own. Seperate physical locations, for the most part they will reside in different countries. Nothing new has been installed on the DC's (patches aside so will investigate). It's worth noting that we have begun, again in the last couple of weeks, to run authencated vulnerability scans however the timings of these events do not tie in with the scan schedule.
    – JLPH
    Dec 2, 2015 at 14:58

1 Answer 1

Reset to default
0

The 0x80000005 status code in the event description means "access denied". So it is possible that some application is trying to record events in the security log but it doesn't have the required permissions (for more reasons for an "access denied" error see http://www.eventid.net/errorsdisplay.asp?error_code=5 - sometimes the message is deceiving). A corrupted log would cause a status code of 0xc0000008 (Invalid handle) so I don't think that's the case here.

Based on the number of events that you mentioned and assuming that the 19 DCs have a similar number of events recorded, it looks like this event is recorded every 30 seconds? Can you verify that? If that's not the case, what is the frequency of the 521 events?

Improve this answer
4
  • Thanks for your reply. I've since carried out some additional research and came to the same conclusion that it must be a 3rd pary application which is generating these events. In fact, the DC's do not have a similar number events, there is quite a difference. The DC's which serve the must users and computers appear to generate far more. The big hitters on average are generating around 1 every two minutes. It's important to note that no single DC is generating these events continously. I'm going to look at the privilieges of accounts that may be running any applications on the DC's.
    – JLPH
    Dec 3, 2015 at 9:20
  • Although during my investigation I found that this status code translates to STATUS_BUFFER_OVERFLOW - msdn.microsoft.com/en-gb/library/cc704588.aspx but I absolutely agree that it looks like a 3rd party application.
    – JLPH
    Dec 3, 2015 at 9:57
  • Indeed, 0x80000005 is actually a buffer overflow condition. By any chance are you using GFI LANGuard for vulnerability scanning? There is a known issue with it causing event id 521 (kbase.gfi.com/showarticle.asp?id=KBID001721. Even if you don't have GFI installed, maybe the suggested registry key that can be adjusted (HKLM\SYSTEM\CurrentControlSet\Control\Lsa) would help fix the problem.
    – AdiGri
    Dec 4, 2015 at 17:12
  • Apologies for the late reply - something I've had a chance to pick up on again. We are using QualysGuard for vuln scanning. We have an LR agent on each DC which constantly accesses ADobjects, generating a large amount of 4662 events. Our Exchange servers are also generating the same when performing accessing AD objects. Wondering if this is related. I'll take a look at the link you posted to see if its fits. Thanks again for your help.
    – JLPH
    Jan 12, 2016 at 22:27

Not the answer you're looking for? Browse other questions tagged or ask your own question.