---
locale: "en"
updated_at: "2026-08-10T09:00:18.454Z"
canonical: "https://www.isdecisions.com/en/fileaudit/docs/support/faq/troubleshooting"
---

# Troubleshooting

Fix common FileAudit issues: missing file accesses, greyed-out Save buttons, backup size changes, and excess audit events.

## Why does FileAudit no longer show new file accesses?

Check the Microsoft Security log configuration on the audited system. If the Security log is full, Windows stops generating new audit events. Set the log to **Overwrite events as needed** so auditing continues once the log reaches its maximum size.

![](https://a.storyblok.com/f/122374/491x510/a07b2a0937/log-properties-security-overwrite.png)

## Why did my server backup size increase after I configured FileAudit?

This is expected and happens only once. 

Changing NTFS permissions or NTFS audit settings resets the archive bit, and FileAudit changes the audit settings when you define the paths to audit. That one change flags the affected files for backup, so the next incremental backup is larger. 

After those files are backed up, the backup software clears the archive bit again. FileAudit does not touch the audit settings afterward unless you ask it to, so the following backups return to their usual size.

## Why is the Save button greyed out on my alert or scheduled report?

Some required fields are missing. Fill in all required fields on the alert or scheduled report, and the **Save** button becomes available.

## How do I reduce the number of events FileAudit generates in the Windows Security event log?

FileAudit enables all subcategories of the Object Access audit, but only needs some of them. 

You can limit the events written to the File Server Security event log by configuring the Advanced Audit Policy to enable just the required subcategories. 

This is a guided procedure: see [Reduce Security event log volume](/fileaudit/docs/guides/configuration/advanced/reduce-security-event-log-volume).

## Why does Windows search generate read events in audited folders?

When a user runs a Windows search in an audited folder, read events can be generated depending on how indexing is set up. 

A search in a non-indexed folder with File Contents search enabled generates a read event for every file in the folder, while a search in a fully indexed folder normally generates none. 

Indexing the searched locations avoids these events. For how to set this up, see [Reduce audit noise from Windows search](/fileaudit/docs/guides/configuration/advanced/reduce-audit-noise-from-windows-search).