[Improvement] Specify Limits on Exporting Audit Logs (Enterprise and Organization) (#61365)

Co-authored-by: Laura Coursen <lecoursen@github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: 3 people

content/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/exporting-audit-log-activity-for-your-enterprise.md

@@ -20,9 +20,15 @@ You can export Git events data by downloading a JSON file from your enterprise a
 
 {% data reusables.audit_log.git-events-export-limited %}
 
-{% data reusables.audit_log.exported-log-keys-and-values %}
+As an alternative to exporting log events, you can use the API to retrieve audit log events. For more information, see [AUTOTITLE](/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/using-the-audit-log-api-for-your-enterprise).
+
+### Export limits
+
+{% data reusables.audit_log.audit-log-enterprise-export-limit %}
 
-As an alternative to exporting log events, you can use the API to retrieve audit log events, or set up {% data variables.product.github %} to stream audit data as events are logged. For more information, see [AUTOTITLE](/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/using-the-audit-log-api-for-your-enterprise) and [AUTOTITLE](/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise).
+### Exported log keys and values
+
+{% data reusables.audit_log.exported-log-keys-and-values %}
 
 ## Exporting audit log data
 

content/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization.md

@@ -174,6 +174,12 @@ You can identify all events that were performed by a specific access token. For
 
 {% data reusables.audit_log.git-events-export-limited %}
 
+### Export limits
+
+{% data reusables.audit_log.audit-log-org-export-limit %}
+
+### Exported log keys and values
+
 {% data reusables.audit_log.exported-log-keys-and-values %}
 {% endif %}
 

data/reusables/audit_log/audit-log-enterprise-export-limit.md

@@ -0,0 +1,13 @@
+{% ifversion ghec %}
+
+There is a hard limit when exporting the audit logs for your enterprise. These limits are either:
+
+* **100 MB** compressed file, or
+* **10 minutes** export processing time, or
+* **both**.
+
+To avoid these limits, we recommend filtering the audit log to a smaller dataset before exporting. For more information, see [AUTOTITLE](/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/searching-the-audit-log-for-your-enterprise).
+
+If you intend to review a large dataset of audit logs, we recommend streaming your logs to an external data management system. For more information, see [AUTOTITLE](/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise).
+
+{% endif %}

data/reusables/audit_log/audit-log-org-export-limit.md

@@ -0,0 +1,15 @@
+{% ifversion fpt or ghec %}
+
+There is a hard limit when exporting the audit logs for your organization. These limits are either:
+
+* **100 MB** compressed file, or
+* **10 minutes** export processing time, or
+* **both**.
+
+To avoid these limits, we recommend reducing the audit log to a smaller dataset before exporting. For more information, see [AUTOTITLE](/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#searching-the-audit-log).
+
+{% ifversion ghec %}
+If you intend to review a large dataset of audit logs, we recommend streaming your logs to an external data management system. For more information, see [AUTOTITLE](/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise).
+{% endif %}
+
+{% endif %}