Confusing Audit Tables

Question

I am having a hard time with Sharepoint auditing right now.

We have a couple of web sites that are keyed to the WSS_Content Content Database. There are two main applications running right now. One of them is just a document library, and another is a little bit more sensitive so we thought we could use auditing to see who was viewing what.

The issue is, that over the past year or so the AuditData table has grown to over 10 GBs, which is more than half of the total database size! This didn't make much sense to me, so I did a little digging. It appears as though we are chewing these about 45k records a day in the Audit Data, but the ratio between what I would consider a 'Real User' and that is audited under 'Sharepoint/System' is about 1:200.

Why does Sharepoint/System have so many records in the AuditTable table?

Answer 1

I believe that search indexer crawl results would be logged under whatever user account crawled those docs. So, if the 'System' account is doing the crawling, that would explain things.

Answer 2

That's draw back of Auditing, if you don't properly planned. if you enabled auditing everything...On your home page you have images, links to other libraries, webpart showing data etc...a user hit the home page of site collection...imagine how much calls made and how much entries goes into audit table....so plan accordingly...

we had the same issue with auditing, one of site collection administrator enabled for everything and for every home page hit, 639 audit entries added...our database grown to 700GB In 2 months....System user is doing alot things on the site collection in background, loading CSS, JS files, processing, executing queries, making calls to dbs etc...

Again, Plan it accordingly.