3 Replies Latest reply on Nov 9, 2011 4:41 PM by SCtbe

    Disabling some of audit log events

    SCtbe

      Hi,

       

      As in subject is this possible? And I'm not asking about ePO user interface functionality - I know that there is no such option.

      Maybe someone knows some "tricks" how to do this, like changing configuration files, editing database, etc.

       

      I know that this is not supported but I need this to decrease database size.

       

      Regards.

        • 1. Re: Disabling some of audit log events
          SCtbe

          Just bumping this thread, maybe someone will have some tips.

          • 2. Re: Disabling some of audit log events
            JoeBidgood

            Apologies, must have missed the original mail...

             

            There's no way to achieve this, I'm afraid: auditing functions by design are hard-coded to prevent tampering. The only option available is to purge audit events.

            That said, I would be very surprised if the audit log is taking up very much space in the database: compared to, for example, the threat events or update events tables, the audit log should be very much smaller. If controlling DB size is your goal I would suggest concentrating on those areas first.

             

            HTH -

             

            Joe

            1 of 1 people found this helpful
            • 3. Re: Disabling some of audit log events
              SCtbe

              In fact thats true, the audit log contains 4 times more events than client or threat event log, but this is cause by specific ePO configuration prepared for strictly controled mass deployment.

              And now it seems that is time for reconfiguration to optimize ePO for day to day work.

               

              Regards.