Message change audit event log

When message change auditing is turned on, audit events related to message changes are written to the custom event log &quotOvConfigChanges."

As administrator, you should be aware of the amount of auditing data that can be generated with message change auditing and should consider increasing the maximum log size for the OvConfigChanges event log. It is important to choose the right strategy for the automatic overwrite of the event log, because the default "Overwrite events as needed" may not be suitable for every customer environment. "Do not overwrite" might be better from an auditing point of view.

Certain specific registry settings can help in this area. See the following URL for details:

http://support.microsoft.com/kb/312571/en-us

Using this information, you can make sure that you do not lose events and that the event log size is still limited. When you use these settings, it is helpful to set up an HPOM event log policy that waits for event 524, described in http://support.microsoft.com/kb/312571/en-us.

Event 524 indicates that the event log has reached its maximum size. When this event occurs, the policy would move the event log file just backed up to another location, so that there is a complete history of all previous event logs (and auditlog entries) available. When message change auditing is turned on, message changes are visible in the event viewer, as shown below:

If you double-click an event from the list, the Event Properties dialog displays attributes of the specified event. See the help topic Message change audit event attributes for details.