|
Posted by on January 26, 2007, 3:59 pm
If you were Registered and logged in, you could reply and use other advanced thread options
Hello,
I am putting together a secure file server. Auditing on files and
folders will be enabled and, of course, performance is a concern. I am
estimating 1-2 events per second, or around 100K events per day.
To minimize impact of the logging, I am considering the following:
- Keeping the SACL small
- Setting the Security log to be 4 GB in size
- Dedicating a 5 GB Raid-10 volume for the logging partition
- Moving the Security log to this partition
As for the SACL, I think "List Folder / Read Data", "Create Folder /
Append Data", and "Delete Subfolders and Files" will capture all of the
important activity.
Is there anything that I am missing? Any other suggestions on how to
improve auditing and security event logging?
Thank you,
J Wolfgang Goerlich
| 
XML site map