Question

You just established an audit policy that enables account logon, logon, object access, and account management. however, when you look at the logs, you see a large number of audit filtering platform connection and audit filtering platform packet drop events that consume most of the security logs. what can you do to alleviate this problem?

Answer 1

The security logs are being consumed mostly by packet drop events and platform connections because these are the most commonly used transactions in the system. To alleviate this problem, make sure that the two highest number of logs are naturally secure and they are performed, no logs will be recorded. This way, only the uncommon and possibly not secure logs will be recorded.