Hello all,

Hopefully a couple of quick questions. I am going to be questioning a few MS admins on log monitoring (Event, System, Security via Event viewer) soon and while I have our policies and standards ruling how often they should do their reviews - I wanted to broker some opinions - don't know if I will get opinons here, but what on your thoughts on how often an admin should review their logs? Once a week, once a day, every second they're awake or other?

Also, thoughts having systems log login attempts, successful and unsuccessful? Should it be done or not? I ask because our organization is looking to turn it off in order to save on disk space... I have not had a chance to slap people around with a flounder to ask more questions about it - but I heard some IT people wanted to turn off that logging... thoughts?

TIA!