https://github.com/osquery/osquery logo
Title
o

OpenPlgx

08/06/2018, 7:48 AM
no. I had left the system running overnight and in the morning I saw the command shell with these events..if I hit the error again, I will collect more telemetry...on the similar note i am also seeing the 50000 count of WEL events getting hit quite often..i would be surprised if windows is generating that many events..
t

thor

08/06/2018, 3:18 PM
Yeah we bumped that limit up quite a bit, our corp config has a max of 200k which has worked well, but there's still a few boxes that exceed that through powershell events
o

OpenPlgx

08/09/2018, 2:20 AM
ok, so bumping the count it is...