---
title: Change audit write behavior
description: Configure buffering for PingIDM audit logging to minimize write operations, using `audit.json` or the admin UI
component: pingidm
version: 8.1
page_id: pingidm:audit-guide:audit-write-adjustments
canonical_url: https://docs.pingidentity.com/pingidm/8.1/audit-guide/audit-write-adjustments.html
keywords: ["Audit", "Logs", "Configuration", "Buffering", "Writes"]
---

# Change audit write behavior

You can buffer audit logging to minimize the writes on your systems. Configure buffering either in `conf/audit.json`, or using the admin UI.

To configure buffering for specific event handler in the admin UI, click Configure > System Preferences and click on the Audit tab. When you customize or create an event handler, you can configure the following settings:

**Audit Buffering Options**

| Property    | UI Text       | Description                                                                                       |
| ----------- | ------------- | ------------------------------------------------------------------------------------------------- |
| `enabled`   | True or false | Enables / disables buffering.                                                                     |
| `autoFlush` |               | True or false; whether the Audit Service automatically flushes events after writing them to disk. |

The following sample code illustrates where you would configure these properties in the `audit.json` file.

```json
...
    "eventHandlers" : [
      {
        "config" : {
          ...
          "buffering" : {
            "autoFlush" : false,
            "enabled" : false
          }
        },
...
```

You can set up `autoFlush` when buffering is enabled. IDM then writes data to audit logs asynchronously, while `autoFlush` functionality ensures that the audit service writes data to logs on a regular basis.

If audit data is important, do activate `autoFlush`. It minimizes the risk of data loss in case of a server crash.