File size of audit log file

[Eric Leung_2]

As I need to bid funding to upgrade more than 100 servers to higher security level, I need to have a rough estimation of extra storage space required for auditing.

I know that there are many factors such as system size, the amount of system activity, the number of events that I am auditing governing the amount of disk space required for auditing. Hence, would some experts / those who have experience on the audit system please tell me how much storage space is required for your server per day based on your experience.

Grateful if you could briefly describe the workload level of your server as well.

MANY THANKS!!

[Noel Miranda]

May not be much help, but look at

http://docs.hp.com/en/5990-8172/ch08s09.html#d0e62529

[Bill Hassell]

Auditing can vary from 1 meg per day to 10 megs per minute. The problem is that you must first specify: what auditing options are you going to enable? If you turn everything on, you may need dozens of gigabytes per day to hold all the logs. The second question is: how many processes will be running (not just waiting) on the system? There is virtually no common method to specify workload, especially on database systems.

Since you already have the systems in place, the best technique is to turn on selected auditing features that you think you can use and see how fast the files grow. Be sure to OVERRIDE the default location for the auditing files and the switch log size with audsys.