Forms authentication failed for the request. Reason: The ticket supplied has expired

Question

My event log is flooded with this message:

Forms authentication failed for the request. Reason: The ticket supplied has expired.

I think this happens when people timeout instead of logout.

First of all , this is not an error, it's Type: Information

I don't want this information, how do I stop ASP.NET from logging it?

My application is not web-farmed, and uses a static machine key.

Answer 1

Here's the solution:

<?xml version="1.0"?>
<configuration>
   <system.web>
      <healthMonitoring>
         <rules>
            <remove name="Failure Audits Default" />
         </rules>
      </healthMonitoring>
   </system.web>
</configuration>

Note that this will prevent the logging off all System.Web.Management.WebFailureAuditEvent events, which covers the event range 4005-4011. There is probably a way to just remove 4005, but this solution is good enough for me.

These are the links that helped me:

• http://msdn.microsoft.com/en-us/library/ms998325.aspx
• http://msdn.microsoft.com/en-us/library/ms998306.aspx

Answer 2

Adding to Max Toro's solution and for the curious, this seems to be the way one would add back 4006 to 4011:

<healthMonitoring enabled="true">

  <providers>
    <add name="EventLogProvider" type="System.Web.Management.EventLogWebEventProvider,System.Web,Version=2.0.0.0,Culture=neutral,PublicKeyToken=b03f5f7f11d50a3a"/>
  </providers>

  <eventMappings>
    <!-- Event Mappings for 0-4004 and 4006 to infinite, skipping 4005, see last attribute of these entries -->
    <add name="Failure Audits 1" type="System.Web.Management.WebFailureAuditEvent,System.Web,Version=2.0.0.0,Culture=neutral,PublicKeyToken=b03f5f7f11d50a3a" startEventCode="0" endEventCode="4004"/>
    <add name="Failure Audits 2" type="System.Web.Management.WebFailureAuditEvent,System.Web,Version=2.0.0.0,Culture=neutral,PublicKeyToken=b03f5f7f11d50a3a" startEventCode="4006" endEventCode="2147483647"/>
  </eventMappings>

  <rules>
    <!-- REMOVE ITEMS NOTED BY MAX -->
    <remove name="Failure Audits Default"/>     
    <!-- ADD Back 4006 to 4011 with these two entries, skipping over 4005 -->
    <add name="Failure Audits Default 1" eventName="Failure Audits 1" provider="EventLogProvider" profile="Default" minInstances="1" maxLimit="Infinite" minInterval="00:01:00" custom=""/>
    <add name="Failure Audits Default 2" eventName="Failure Audits 2" provider="EventLogProvider" profile="Default" minInstances="1" maxLimit="Infinite" minInterval="00:01:00" custom=""/>
  </rules>

</healthMonitoring>

Seems to work for me.