# Audit logging initial volume

**URL:** <https://discuss.elastic.co/t/audit-logging-initial-volume/173402>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [March 21, 2019, 8:56pm UTC](https://discuss.elastic.co/t/audit-logging-initial-volume/173402 "2019-03-21T20:56:48Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![rugenl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rugenl/32/12887_2.png) [@rugenl](https://discuss.elastic.co/u/rugenl)\
**Post date:** [March 21, 2019, 8:56pm UTC](https://discuss.elastic.co/t/audit-logging-initial-volume/173402/1 "2019-03-21T20:56:48Z")

</div>

I turned on audit log to files on a single node cluster. It started generating about 8700 audit events per minute with no one using the cluster. What should be turned off to get this down to a manageable volume?

---

<div class="post-metadata">

**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\
**Post date:** [March 21, 2019, 9:36pm UTC](https://discuss.elastic.co/t/audit-logging-initial-volume/173402/2 "2019-03-21T21:36:19Z")

</div>

Hi

I'd start by reading through [our documentation](https://www.elastic.co/guide/en/elastic-stack-overview/6.6/auditing.html) and [this nice blogpost](https://www.elastic.co/blog/elasticsearch-audit-trail-and-log-file-filter-policies-explained) that explains ignore policies

---

<div class="post-metadata">

**Author:** ![rugenl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rugenl/32/12887_2.png) [@rugenl](https://discuss.elastic.co/u/rugenl)\
**Post date:** [March 21, 2019, 10:05pm UTC](https://discuss.elastic.co/t/audit-logging-initial-volume/173402/3 "2019-03-21T22:05:15Z")

</div>

Yes, the doc is pretty good at showing how to exclude things, but not so much on explaining best practices for excluding. It seems to give some hints in the examples, but not why.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 18, 2019, 10:05pm UTC](https://discuss.elastic.co/t/audit-logging-initial-volume/173402/4 "2019-04-18T22:05:15Z")

</div>

Closed on April 18, 2019, 10:05pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.