Developing a Good Audit Policy

You can only use the auditing feature effectively if you develop an audit policy that both generates the events that you are interested in seeing and generates few enough events that you can effectively manage the resultant logs.

Many administrators who have not yet used the feature start by enabling all audit policy, only to be dismayed in short order by the large volume of events that is generated.