Hi folks,

I need some help with something I've been pulling my hair out about.  So I need to put the exchange audit logs on a separate partition.  So I've been combing through the server settings in the ECM but there doesn't seem to be any option to reconfigure and direct the log to be stored on another drive, or at least I haven't seen it yet.  Google has turned up information as to where the audit logs are and how to change the level of auditing but nothing I've found says how to change the location.

--wilsonr

The Exchange mailbox audit logs are stored in the individual mailboxes.  The admin audit logs are stored in a mailbox, as well (I can't remember which one, exactly).  So you can't easily "put the exchange audit logs on a separate partition".

Hi,

The mailbox audit logs for that mailbox are located in the mailbox. Log entries are stored in the Audits subfolder of the audited mailbox Recoverable Items folder. This ensures that all audit logs are available from a single location, regardless of which client access method was used to access the mailbox or which server or workstation an administrator used to access the mailbox audit log. So we cannot and there is no need to change the location of mailbox audit logs (Anyway these mailbox audit logs will be deleted ).

By default, mailbox audit log entries are retained in the mailbox for 90 days and then deleted. You can modify this retention period by using the AuditLogAgeLimit parameter together with the Set-Mailbox cmdlet.

For more information, please refer to this document

https://technet.microsoft.com/en-us/library/ff459237(v=exchg.141).aspx#RTT

Best Regards.