Re: Auditing Vs Performance

Hello MLtt,

Since you are more interested in Failures, why not configure editing for that alone. Also, there may be less failures and than success which will help your logs volume

--
Isaac Oben [MCTIP:EA, MCSE]
"MLtt" <teknologix007@xxxxxxxxx> wrote in message news:%23tQb9WvoJHA.4028@xxxxxxxxxxxxxxxxxxxxxxx
Hi all. I recently became suspicious that some users on my network are making
misuse of the files on the server. Therefore I enabled audditing for both
successfull and failed attempts. This made the secutiy log large enough and
created a performance overhead. In fact the backup routine done in the night
did not complete in the required time and I had to terminate it and remove
auditing to be able to complete.

My question is this...is there a way to enable auditing and at the same time do
not create a performance bottleneck? so that backup could complete? or which
auditing entries are the most essential?

Grazias




.

Quantcast