Event Viewer and Security View

From: Fritz (pjfritzler@earthlink.net)
Date: 05/21/02


From: "Fritz" <pjfritzler@earthlink.net>
Date: Mon, 20 May 2002 20:35:10 -0700


Is there any way when I am auditing object access (success
and failure) that I can limit what part of the event is
actually logged?

The problem I have is that when I configure a single event
to audit such as "traverse", every single handle event is
logged. This will generate 6 separate events per
instance, all but two of them basically useless.

Yes, I know that I can filter the events that I actually
view, but this just causes a long delay when I open the
view itself. In addition, these "handle" events just load
up the log and consume disk space for no reason.

HELP!

Thanks in advance,

Fritz