The more log file generations there are, the more overhead will be associated with the rotation of the destination file. You can keep the number of generations relatively small by specifying a large size for the audit log file, to reduce how often file rotation takes place.

The following table shows examples of estimating the file size for an audit log file intended to remain in use for seven days.

Table 3-11 Examples of audit log file estimation

Example of audited system	Acquired audit logs	Size added to audit log file per day	Maximum size of audit log file value specified in the log_audit_size operand)
For auditing primarily of operations related to starting and stopping OpenTP1 and user servers: OpenTP1 startup and shutdown: Once per day User server startup and shutdown: Once per day 100 servers	KFCA33400-I (startup of OpenTP1) KFCA33402-I (normal termination of OpenTP1) KFCA33405-I (startup of user server) KFCA33406-I (normal termination of user server)	60 KB (approx.)	1 MB
For auditing primarily of operations related to executing services (on a subset of the servers in the OpenTP1 system) Number of user servers to be monitored: 5 Number of service functions executed per server: 60/hour Daily uptime: 8 hours Number of times audit logs are acquired: Once per service	KFCA34000-I (a size of 400 bytes is assumed for each optional log and log message issued by UAPs)	1 MB (approx.)	10 MB
Auditing primarily for operations related to executing services (on all the servers in the OpenTP1 system) Number of active user servers: 100 Number of service functions executed per server: 60/hour Daily uptime: 8 hours Number of times audit logs are acquired: Once per service	KFCA34000-I (a size of 600 bytes is assumed for each optional log and log message issued by UAPs)	28 MB (approx.)	200 MB

Note:

• Estimate the size of the audit log file and the number of generations after estimating the quantity of audit log information produced per unit of time.
• For details of the quantity of audit log information output for each event, see C. Information Output for Audited Events.