Hard Disk Space Management

As events occur across Domains & Servers, the event logs get filled with data, that are processed for meaningful information (reports / forensics) and later archived (save disk space & historical reporting); the disk space required to store the ever growing event log data is unique & depends on the number of domain controllers, file servers, workstations...

Don't for one second think we advice you to refrain from adding DCs & Servers..... However, with increased resources come, increased need for disk space and we will do our best to suggest the most optimum RAM, minimum disk space and event log settings and in turn ensuring the apt auditing environment.

• Hardware Requirements
• Software Requirements
• Active Directory Auditing
• File Server Auditing
• Disk Space Alerts

Hardware Requirements

Hardware	Recommended
Processor	P4 - 1.5 GHz
RAM	2 GB
Disk Space	20 GB

Software Requirements

Supported Microsoft Windows Operating Systems

Windows XP | Windows Vista | Windows 7 | Windows 8 | Windows 8.1

Windows Server 2003 | Windows Server 2008 | Windows Server 2008 R2 | Windows Server 2012 | Windows Server 2012 R2

Supported Platforms

Active Directory 2003 and above

Windows File Server 2003 and above

NetApp Filer - Data ONTAP 7.2 and above

Windows Failover Cluster with SAN

Disk Space Requirement

The hard disk requirements computation for Active Directory Auditing & File Server Auditing are detailed in the tables below. The numbers reached are with a simple calculation based on the number of users, number of days and the approx size of an event log.

Active Directory Auditing

Number of Users	Number of Days	Total Size
1	1	15 KB
10000	90	15 * 10000 * 90 = 13500000 KB (13 GB)

For example, let us imagine the below scenario:

No of Domain Controllers : 5

No of users : 10000

No of Days : 90

Average log size : 15 KB

Disc Space : Average Log Size * No of Users * No of Days

: 15 kb * 10000 * 90 = 13500000 (12.8 GB)

Archive : (Average Log Size * No of Users * No of Days) / 10

: (12.8 GB) / 10

As the 'Archived' logs will be zipped, the folder size will reduce by 90%, making the zipping ratio as 10:1.

Total Disc Space = Archive (1.28 GB) + 12.8 GB (Approx for 15 kb * 10000 Users * 90)

File Server Auditing

Number of Users	Number of Files	Number of Days	Total Size
1	1	1	4 KB
100	1	1	400 KB
100	100	1	40000 KB (40 MB)
100	100	90	40000 * 90 = 3.5 GB
100	100	720 (2 yrs)	40000 * 720 = 29 GB

Disc Space : Average Log Size * No of Users * No of Files * No of Days

Archive : (Average Log Size * No of Users * No of Files * No of Days) / 10

As the 'Archived' logs will be zipped, the folder size will reduce by 90%, making the zipping ratio as 10:1.

Total Disc Space = Archive + Disk Space

Tips to keep disk space on check

Disk Space Alerts

An administrator can configure a threshold value for free disc space. When the free space on the Server goes below the threshold, an alert will be sent to the configured email address.

i. Check size of ev_temp & temp folder & ensure it is empty or having very few files.

ii. Check logs folder size is not more than 1 GB.

If the above two scenarios are not as mentioned above, seek technical assistance:

Email : ADAudit Plus Support | DID : +1-408-916-9891 | Toll Free : +1-888-720-9500

Data Archiving

Data archiving in ADAudit Plus allows organizations to archive processed audit data to an archive folder by compressing the files to a zip format at the intervals mentioned, ensuring forensic and compliance requirements. The 'days' (in the image below) refers to the number of days the event log data is stored in the Active Database, which will later be archived based on the 'Archive Events' under Admin tab.

For Technical Assistance: Email : ADAudit Plus Support | DID : +1-408-916-9891 | Toll Free : +1-888-720-9500

Windows AD & Servers Auditing Advantage using ADAudit Plus

	Events Monitoring			Archive Data
	Track every Active Directory & Servers modifications by Admin, Users, Helpdesk, HR etc.			Archive AD event data for Security and Forensics.
	Dashboard View			32 bit | 64 bit
	Single view of all critical audit data for configured domains.			Support for both 32 bit and 64 bit Windows platforms.
	Reports & Alerts			Export Reports & Meet Compliance
	View pre-configured reports and set email alerting for changes to monitored folders / files.			Meet PCI, SOX, GLBA, FISMA, HIPAA Compliance with audit reports in XLS, CSV, PDF and HTML formats.
	IT Auditors			Important Features
	Logins for IT Auditors with reports view only.			Here, only the important features are listed, for the many, many more features experience an Online Demo of ADAudit Plus.