3.2. How to reduce the number of audit events
Enabling certain audit flags, such as the View audit flag, can result in a massive amount of audit events in a SharePoint farm. However, it might be necessary to monitor View events at least for parts of the farm. Here are two possible solutions:
- LOGbinder for SharePoint enables specifying different audit policy for each site collection. So, turn on the View audit flag only for the site collections where it is necessary.
- If it is still not granular enough, it is possible to turn on View audit flag for only specific libraries or lists. To achieve this, turn off the View flag for all site collections in LOGbinder, and then enable it only on certain libraries or site collections in SharePoint by following the instructions in the article How to Audit an Individual Library or List in SharePoint.