locked
Audit log trimming settings RRS feed

 > 

  • Question

  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi,

    I have some questions on what the outcome will be depending on some settings you make to the audit log trimming.

    I have read microsoft documentation and various blogpost and it is the wording of the settings that I need some clarification on.

    - My timer job for audit log trimming is set to run monthly, i.e at the end of every month

    - My setting for audit log trimming on a site collection is 

        - Do you want to trim? YES

        - Optionally, specify the number of days: 40

        - If you'd like to keep audit data for longer than this: EMPTY/BLANK

    I set this up on the 10th of may.

    What will happen on the 31st of may?

    What will happen 40 days after the 10th of may?

    /Daniel

    Thursday, May 16, 2019 9:03 AM

Answers

  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi, Daniel,

    In SharePoint Content Database we have a table named  AuditData. This table  stores audit logs when “Auditing” enabled in Site or List Libraries. Even you set the “Automatically trim the audit log for this site” yes and set retention for 3 days (like in example) . The logs will not be deleted from Content Database until “Audit Log Trimming” timer job is run. After timer job runs, the logs until retention value ( 3 days in example) will be deleted.

    It does not matter when you make the setting. The number of days of audit log data to retain determines how long the log will be kept in the AuditData table in the SQL server.

    I will make a brief simulation according to your setting( 40 days to retain, timer job run monthly at the end of every month, no path for “keep audit data…” ).

    SharePoint will audit all the selected behavior in the AuditData table in the content database. The log retained over 40 days will be flagged to be deleted.  Before the audit log trimming timer job run, you can still see the log via audit log reports.

    When the end of the month come(it varies in my end , may be one or two day before the last day of the month ), the audit log trimming timer job will scan all the log, and delete the old logs which have been kept over 40 days. Then, you will not be able to find these records in the audit log reports in site settings. For your example, the line will be around April 20<sup>th</sup>, logs recorded earlier than that will be deleted.

    You left blank in “If you'd like to keep audit data for longer than this” option. So the deleted logs will be not saved. You will have no way to find them again. If you select a library to keep audit data for longer than this, the logs will be saved as csv files in this certain library before trimming occurs.

    You can take a look at this article. It is about SP 2010, but the behavior is same in SP 2016: https://blog.bugrapostaci.com/2012/09/05/how-to-trim-audit-logs-in-sharepoint-20072010/

    Best Regards

    Jerry Xu

    Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    SharePoint Server 2019 has been released, you can click here to download it.
    Click here to learn new features. Visit the dedicated forum to share, explore and talk to experts about SharePoint Server 2019.


    Monday, May 20, 2019 2:52 AM

All replies

  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi, Daniel,

    In SharePoint Content Database we have a table named  AuditData. This table  stores audit logs when “Auditing” enabled in Site or List Libraries. Even you set the “Automatically trim the audit log for this site” yes and set retention for 3 days (like in example) . The logs will not be deleted from Content Database until “Audit Log Trimming” timer job is run. After timer job runs, the logs until retention value ( 3 days in example) will be deleted.

    It does not matter when you make the setting. The number of days of audit log data to retain determines how long the log will be kept in the AuditData table in the SQL server.

    I will make a brief simulation according to your setting( 40 days to retain, timer job run monthly at the end of every month, no path for “keep audit data…” ).

    SharePoint will audit all the selected behavior in the AuditData table in the content database. The log retained over 40 days will be flagged to be deleted.  Before the audit log trimming timer job run, you can still see the log via audit log reports.

    When the end of the month come(it varies in my end , may be one or two day before the last day of the month ), the audit log trimming timer job will scan all the log, and delete the old logs which have been kept over 40 days. Then, you will not be able to find these records in the audit log reports in site settings. For your example, the line will be around April 20<sup>th</sup>, logs recorded earlier than that will be deleted.

    You left blank in “If you'd like to keep audit data for longer than this” option. So the deleted logs will be not saved. You will have no way to find them again. If you select a library to keep audit data for longer than this, the logs will be saved as csv files in this certain library before trimming occurs.

    You can take a look at this article. It is about SP 2010, but the behavior is same in SP 2016: https://blog.bugrapostaci.com/2012/09/05/how-to-trim-audit-logs-in-sharepoint-20072010/

    Best Regards

    Jerry Xu

    Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    SharePoint Server 2019 has been released, you can click here to download it.
    Click here to learn new features. Visit the dedicated forum to share, explore and talk to experts about SharePoint Server 2019.


    Monday, May 20, 2019 2:52 AM
  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi Jerry,

    Thank you for a very detailed description!

    Just one question

    "If you select a library to keep audit data for longer than this, the logs will be saved as csv files in this certain library before trimming occurs."

    If I chose this option, to save the log in a library, will it be done automatically by the timer? I think I have read somewhere that I have to make this happen programmatically by myself..?

    /Daniel

    Tuesday, May 21, 2019 6:07 AM
  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi, Daniel,

    Per my test in SharePoint 2013 and 2016, the files were saved automatically right before the timer job deleted the logs in the AuditData table.  

    And every time you check the audit log through the "Audit log report" option in site setting, you will be asked to select save location. Then a audit log report will be generated to the selected path. If you select a library to keep audit data before, that library path will be the default path for you to save audit log report. 

    Best Regards 

    Jerry Xu

    Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    SharePoint Server 2019 has been released, you can click here to download it.
    Click here to learn new features. Visit the dedicated forum to share, explore and talk to experts about SharePoint Server 2019.

    Tuesday, May 21, 2019 6:20 AM
  • Question
    Sign in to vote
    0
    Sign in to vote
    Thanks again, I am keeping an eye on our audit trimming at this months end and I will get back.
    Tuesday, May 28, 2019 8:36 AM