You are viewing limited content. For full access, please sign in.

Question

Question

does removing a date range from audit trail delete the audit data or just make it unavailable for reporting until the date range is added back in when needed?

Audit Trail
Updated April 30, 2015
asked on September 16, 2014

I have a customer that has the date range for audit trail set to retrieve the last 2000 days. The volume that this repository see's is very large, something like 70,000 images being added daily. Audit trail times out, or errors if I try to report and i suspect it's because of the date range setting being set so far out. If I remove this date range setting, and change it to be the last 60 day's, the audit data will still be available, just not for reporting for past 60 days unless I specifically add it back in right?

 

0 0

Answer

APPROVED ANSWER
replied on September 16, 2014

Correct. The actual audit data stored in the binary audit logs will not be deleted.

 

When you change the Audit Trail date range, you are just telling Audit Trail what data from those binary audit logs to load into the Audit Trail database, and thus can be reported on.

0 0
replied on September 16, 2014

Thanks Alex, I was pretty sure that was the case, just wanted to verify. I don't work w/ audit trail every day so its nice to get confirmation.

0 0

Replies

replied on April 29, 2015

Adding a bit to this topic -

 

When using the Repository + Files Option, the understanding is that the DB is loaded with the date range specified in the AT Configuration manager, and that this information comes from the log files.  The question is, what happens to previously loaded data?  In the case where we have a year loaded, and then we change the data range to a month somewhere in that year, is the data before and after that month removed from the DB?  Also, if we need to retain ALL data, can we walk back over time without re-loading everything?  In other words, If I loaded the last year, and then edit the date range to include the last two years, does if reload everything, starting with the last year, or does it just go in and begin where it left off? 

 

With a large body of data to scroll through, are there indexes we can add, and or timeout intervals we can increase for long running reports?  Are there any tips/guides on straight SQL we could execute to replicate the reports, and/or simplify them as needed?

 

And finally, since the DB is re creatable, we are using a Simple recovery model.  Is this what LF would recommend?

 

TX

2 0
replied on April 29, 2015

AT won't delete data that falls within an existing range.  Adjusting a range larger will just pull in new data, adjusting it smaller will just delete the data that no longer falls within it.

Newer schemas (since 9.0?) should have additional indexes to make reports faster, and AT itself should have increased timeouts on the reporting side.  If you still have filters that take an excessive amount of time to execute, you can pursue what with the usual SQL profiling tools.

Simple recovery model is usually sufficient.  The only case where you might do something else is if running audit reports is a mission critical function and needs to be back up quickly in the event of a server crash.

2 0
replied on April 30, 2015

Little confused by this answer.

 

"AT won't delete data that falls within an existing range."

then

"adjusting it smaller will just delete the data that no longer falls within it."

 

So, it will not delete the data, it will only delete it?

 

I understand that data that falls within the date range will be present in both the log files and in the database, but if I change that from 2000 days to 90 days, will my database shrink?  Should I delete the database and let it re-create with the new date range?

 

replied on April 30, 2015

Ok, so I just did a test on the empower VM.

 

Initially, with a date range of 365 days my audit database was 79.55MB.  I then went into the audit trail config and changed that range to 90 days and after a few minutes (10-15 is when I checked back) it was down to 42.12MB.

 

So this looks like AT will delete the data that was in the database, but now falls outside the new date range you make. 

0 0
You are not allowed to follow up in this post.

Sign in to reply to this post.

Details
Related Posts
Loading ...