Event ID 5149 – The DoS attack has subsided and normal processing is being resumed.
|Category||Object Access: Other Object Access Events|
When a DoS attack has been thwarted and normal processing is resumed, event 5149 is logged. This event occurs very rarely, and is designed for alerting the administrator that an ICMP DoS attack has ended.
An example of 5149 event log:
The DoS attack has subsided and normal processing is being resumed.
Why does event ID 5149 need to be monitored?
The logging of this event indicates that there is an ICMP DoS attack, or that there are hardware and network device related problems. Either way, it is prudent to investigate the cause of this event.
Event 5149 applies to the following operating systems:
- Windows 2008 R2 and 7
- Windows 2012 R2 and 8.1
- Windows 2016 and 10