One of our cms is howing a red danger on health as number of auditing events in queue is continuing to grow - approcahing over 5000.
We have removed all the 0gb old auditing fiels on disk but still growing.
How can we get this number to come down significantly.
Auditng db has enough space and no firewalls in domain.
Also have some redundant servers which show auditing data in buffers - we would rather delete these old services rather than enable them to get the small number of auditing events they have in queue to zero.
Is this ok assume if remove the service would remove any old auditing events in the buffers.
Auditing thread utilization showing 100% sometimes but only have the defaulty auditing enabled and in evenings not much happening so should be getting dequeued successfully but this isn;'t happening.