I want to capture the audit of server configuration settings changes.
For this I setup the SERVER_OPERATION_GROUP audit event.
This event is raised when Security Audit operations such as alteringsettings, resources, external access, or authorization are used.Equivalent to the Audit Server Operation Event Class.
The audit file max size is configured as 1GB, and rollover configured for 100 files. Therefore I have 100GB worth of audit data.
The challenge I am faced with is that this audit captures multiple things like VSST (view server state) which is resulting in a 1GB file getting generated every 5 mins. Therefore I have got audits of only the last 500min = 8 hours.
Is there a way to capture the configure setting change excluding view server state events so that I can retain audit for a longer duration like 1 week without having to increase audit size/files?