Preinstallation Recommendations for Auditing Devices

Configure your system with the minimum number of auditing devices you require – you must configure at least three devices. You can use sp_addaudittable to add more auditing devices later. See the Reference Manual: Procedures.

Install auditing tables and devices in a one-to-one ratio. Tables that share the same device also share the same upper threshold limit. These tables cannot be used sequentially when a device fills up, because they both reside on the same device.

Install each auditing table on its own device. This enables you to set up a smoothly running auditing system with no loss of auditing records. With two auditing tables, when one fills up, you can switch to the other. With a third auditing table, if one device fails, the system security officer can install a new threshold procedure that changes the device rotation to skip the broken device until the device is repaired.

Make the device larger than the table. When you use only three auditing tables and devices, the size of the table and the size of the device can be similar, because you can obtain more auditing capacity by adding more auditing tables and devices. When you are working toward the upper table and device limit (six to eight), you may want to make the device considerably larger than the table. You can later expand the table size toward the upper size of the device when a larger auditing capacity is desired, and few or no device additions are available.