If you install SNARE on a Windows 2003 Server to push events to CS-MARS, what is the default logging level of SNARE. Somone told me that the default level of SNARE is lower then the log level that we currently have set on our Windows 2003 Server. I was under the impression that SNARE converts the string format of the event log record to text format and simply pushed the events to CS-MARS regardless of logging levels on Windows. What would happen if you did no select Allow SNARE to automatically set audit configuration and Allow SNARE to automatically set file audit configuration?. would CS-MARS still get events from windows devices?