Determine the location of the raw devices you need for the sybsecurity, syslogs, and sysaudits table devices. You will need to provide this information later.
It is recommended that you configure your system with the minimum number of auditing devices you require—you must configure for at least three devices. You can add more auditing devices later with sp_addaudittable. For information, see the Adaptive Server Reference Manual.
Sybase recommends:
Installing auditing tables and devices in a one-to-one ratio
Tables that share the same device will share the same upper threshold limit. These tables cannot be used sequentially when a device fills up, because they both reside on the same device.
Installing each auditing table on its own device
This enables you to set up a smoothly running auditing system with no loss of auditing records.
With two auditing tables, when one fills up, you can switch to the other. With a third auditing table, if one device fails, the System Security Officer can install a new threshold procedure that changes the device rotation to skip the broken device until the device is repaired.
Making the device larger than the table
When you use only three auditing tables and devices, the size of the table and the size of the device can be similar, because you can obtain more auditing capacity by adding more auditing tables and devices (up to eight). When you are working toward the upper table and device limit (six to eight), you may want to make the device considerably larger than the table. Then, you can expand the table size later towards the upper size of the device when a larger auditing capacity is desired, and few or no device additions are available.
