While logging audit events for the following object, the directory service reached the maximum number of audit events that ...

While logging audit events for the following object, the directory service reached the maximum number of audit events that could be cached in memory at any given time. As a result of reaching this limit, the operation was aborted.



Maximum number of audit events that can be cached:
%1



Distinguished name of object:
%2



Generally this occurs if there are a large number of changes being performed on attributes that require auditing. An example of such an operation could be deleting the membership of a large group, where the ‘member' attribute is being audited.




Additional Data From the Audit Event

Attribute name or old distinguished name:
%3



Attribute value or new distinguished name:
%4




User Action

(1) Check that an excessive number of object creation, modification, move, rename or undelete operations are not being performed.

(2) Check that an excessive amount of auditing is not enabled.  For example, confirm that auditing is not configured for more attributes than is necessary.

(3) If necessary, increase the size of the audit queue by increasing the 'Maximum Audit Queue Size' registry parameter.