▲
12
Event 1102, the audit log was cleared. How seriously should I take this?
Got one on a member server. Our sysadmin says it was probably housekeeping.
Got one on a member server. Our sysadmin says it was probably housekeeping.
It is on every intrusion checklist as roughly step one after getting privilege, because it removes the record of how they got in.
Sometimes it really is an admin being tidy. That is a training conversation rather than a shrug, and it is worth finding out which before deciding.
seriously enough to get an answer that makes sense. there is no housekeeping procedure that requires wiping the security log, it rolls over on its own