Determine the location of the raw devices you need for the sybsecurity, syslogs, and sysaudits table devices.
Configure your system with the minimum number of auditing devices you require—you must configure at least three. You can add more auditing devices later using sp_addaudittable. For information, see the Reference Manual: Procedures.
Install auditing tables and devices in a one-to-one ratio. Tables that share the same device will share the same upper threshold limit. These tables cannot be used sequentially when a device fills up, because they both reside on the same device.
Install each auditing table on its own device. This enables you to set up a smoothly running auditing system with no loss of auditing records.
With two auditing tables, when one fills up, you can switch to the other. With a third auditing table, if one device fails, the system security officer can install a new threshold procedure that changes the device rotation to skip the broken device until the device is repaired.
Make the device larger than the table. When you use only three auditing tables and devices, the size of the table and the size of the device can be similar, because you can obtain more auditing capacity by adding more auditing tables and devices. When you are working toward the upper table and device limit (six to eight), you may want to make the device considerably larger than the table. You can then later expand the table size towards the upper size of the device when you need a larger auditing capacity is desired, and no additional devices.