Hi
Lately, I am seeing below logs from Exchange server:
"AgentDevice=WindowsLog AgentLogFile=Application Source=Microsoft-Filtering-FIPFS Computer=XYZ User=NETWORK SERVICE Domain=NETWORK SERVICE EventID=1102 EventIDCode=1102 EventType=4 EventCategory=0 RecordNumber=XYZ TimeGenerated=XYZ TimeWritten=XYZ Message=MS Filtering Engine Update process is running. "
Per event ID 1102 it means that audit logs are cleared. Can someone tell me why the audit logs are being cleared by NETWORK SERVICE? what exactly is causing it and whether it is expected? I confirmed with the team that they didn't make any changes.



