Elasticsearch kibana 7.8 give false information ?!

Elastic Stack Beats
1

Hello , i am using Elasticsearch ,kibana and beats 7.8 , while i am using winlogbeat i have noticed illogical information ,

image
image1298×417 24.8 KB

suring the last 15 min ( i didn't even open the machine that is working with winlogbeat , it detects so many events , for login 4624 it shows 36 count which is not true at all , i don't know why does it show that ?!

2

Winlogbeat will be extracting whatever information you see from the host.

Have you logged onto that machine and taken a look through the event viewer to see if what you are seeing in Kibana matches?

3

Actually i have focused in event log 4624 , which means number of login , i didn't login in to the machine 3 days ago, and it gives that i have successfully login 36 times in 15 min ? !!
That's not even logic !

4

Maybe there's a service or process that is running using your account?

5

How can i check that , which service, should i restart winlogbeat service for example?

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.