Reducing event log reporting from the service

[snblackout]

@devnulli thanks again for your prompt replies and improvements.

On one of my servers I checked to see how many event logs were being created in 1 hour and it's about 3600, which is kind of a lot so if other applications on the server have issues, the service is pushing them down and out of view quickly.

I propose a better way for reporting. Potentially a button on the console that you can create an HTML report of the data the server has of IPs and saves it to a particular folder to open in a browser to look through.

Thoughts?

[devnulli]

Hi,
Just to make sure. 😅
Whats in those entrys? Is it "found xxx", " banned xxx" (Info Level) Or is it."checkin log" ...nothing found.." ? (Verbose Level)

If its info level, you really need different ways of reporting , and we should think of something

If its verbose Level, you can turn the log level up in the config.

[snblackout]

Most of them are below. I have seen a couple 'banned XXX" but I would have to say vast majority are below.

BlockRDPBrutersByRdpCore131: found 193.93.62.73, trigger count is 3

I did notice going through, some have a very high trigger count. Looking at the console, that IP is not in the temp or perma banned. Interesting.

BlockRDPBrutersBySecurity4625: found 186.96.174.85, trigger count is 376

[devnulli]

Hi, I think it would be good to bring the Found ... messages to from Log Level Info to Log Level verbose. That way, they would not normally get logged into the windows log, unless you crank the log level down to Verbose. What remains is the entries when EvlWatcher is banning or lifting a ban.

Do you think that would be sufficient?

[snblackout]

That could work. Would the event logs that are created for banning or lifting ban be for temp and perma? Since I will be watching for that high trigger count, I kinda have to keep it as is for now though.