0

Perhaps showing my ignorance, but is there any reason to keep the Message from a Windows event, when ingesting into a log system?

Is it the case that these are composed of data from other attributes, for localization/readability, and could be discarded without losing important data?

I don't know if this is the right spot to read, but this seems to point to that case?

Scope:

Only care about Microsoft-y events. If some random person could in theory write their own event with unique data in the message field via PowerShell or some other ad hoc means, I don't care about that

Context:

Ingesting into a logging system, and the message field bloats storage significantly. Generally, details about the meaning of an event is well documented , or could be explored on a local system when building tooling to expose the data once it ships to the log system, sans message

Thanks!

2

In the IT security field, it may be interesting to disable the collection of the "Message" part while collecting events into a SIEM, . This will reduce the size of the transmitted data and will also reduce the load of the collector server.

When using the Windows Event Collector (WEC) feaure, it is possible to disable the collection of the "Message" by switching from "RenderedText" (so with the full "Message") to the optimized mode "Events" (without the “Message”) in the subscription settings. This is shown in the image below in "ContentFormat".

enter image description here

1
  • Yep! For what it's worth, we went from 4.6 million documents in 7.5GB, to 4.7 million documents in 4.3 GB. Unscientific single day comparison with message stripped from all events, but a pretty decent savings. We'll likely strip them only from specific high-volume events where they don't add value going forward. Feb 7 '19 at 14:25
2

It appears that the message field, at least, for pre-defined event schema, can be discarded.

Thanks to josh_p for pointing to this blog

An example showing how the Message field is composed for a particular event id:

( Get-WinEvent -ListProvider Microsoft-Windows-GroupPolicy ).Events |
 Where-Object {$_.Id -eq 5314}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.