We are running the default trace on two of our MSSQL 2005 databases and one of them is pulling in over 300gb of event data per month. This is causing major disk space issues and when I look at most of this information, it's not helpful at all. As these are in our PCI environment, we have been told by our auditors that we only need to pull event data from certain tables within each database and not all of the events in the default doc from RSA. Has anyone else ever done this? Customized it to just pull from a specific table? If so, how do I go about that as I'm at a complete loss. Currently, I'm going thru the default doc to comment out most of the events being pulled in the hopes this will decrease the size of these trace files.