Auditing Vs Performance

  • Thread starter Thread starter MLtt
  • Start date Start date
M

MLtt

Hi all. I recently became suspicious that some users on my network are
making
misuse of the files on the server. Therefore I enabled audditing for both
successfull and failed attempts. This made the secutiy log large enough and
created a performance overhead. In fact the backup routine done in the night
did not complete in the required time and I had to terminate it and remove
auditing to be able to complete.

My question is this...is there a way to enable auditing and at the same time
do
not create a performance bottleneck? so that backup could complete? or which
auditing entries are the most essential?

Grazias
 
Have you considered simply restricting permissions on relevant files to the
appropriate level? If this is not feasible, minimize level of auditing by
targeting only types of events and users/groups which are relevant to your
investigation...

hth
Marcin
 
Back
Top