Welcome Serena Central users! CLICK HERE
The migration of the Serena Central community is currently underway. Be sure to read THIS MESSAGE to get your new login set up to access your account.
Highlighted
Outstanding Contributor.. PerthRM8 Outstanding Contributor..
Outstanding Contributor..
163 views

Quick one: AuditLogs, Online ones, do you delete old ones, when?

120 Million rows of TRIM Audit Logs, is it time for the Clean-Up, do we have to clean them up (We do have the Offline Audit Logs as well), what is the practice in the industry? (Govt Dept).

Do you keep online and offline Audit Logs?

Do you save the offline Audit Logs daily in TRIM file?

Is it a good thing to, for example, get rid of the all Online Audit Logs older than 3 years …. ? We have TRIM since 2002....

What is the impact of 120 Million logs on the TRIM SQL database

Does this number of rows slowing down the system, search etc?

What is your experience..

Need this info for tomorrow's meeting

Thanks

 

 

 

 

0 Likes
2 Replies
Micro Focus Expert
Micro Focus Expert

Re: Quick one: AuditLogs, Online ones, do you delete old ones, when?

Sorry - I see no one's replied to your (very common) question.

Personally I'm not aware of any legislation dictating what type of online audit entries should be kept, how many, or for how long. They're really just there for convenience since when push comes to shove the authoritative source of audit information is considered to be the offline audit logs.

A large database table of online audit entries isn't typically going to slow down day-to-day operations from a user viewpoint unless there's an admin user who's trying to search that data: at that moment there's a potential for their search to place a significant load on the database server while it searches through 120 million rows, so users may notice a slowdown while that happens.

There's also the added space all that data takes - it makes the overall CM database larger and hence backups are larger and take longer. 

In my experience it's a fairly typical temptation for Records Management people to want to keep all this data indefinitely, just in case, because they can. I was guilty of this in a previous life when I administered a government department's document management system.

In the good old TRIM Captura (4.3) days the system options defaulted to only keeping the last 10 online audit entries for any one record, and from memory it only allowed you to increase this to a maximum of 99. Most organisations never bothered setting it higher than 10 and users accepted that.

Would I recommend leaving 120 million rows of online audit events in the database? Absolutely not. How many is the right number? When was the last time someone needed to look at online audit events for a record going back further than about a year? Would they kick up a stink if there were only ever a year's worth to look at, and if they needed to look at something older they had to go to offline logs?

Neil

Note: Any posts I make on this forum are my own personal opinion, and unless stated otherwise do not constitute a formal commitment on behalf of Micro Focus.

(Please state the version of CM you're using in all posts.)

MySupport: https://softwaresupport.softwaregrp.com/

If you find this post useful, please use the and/or buttons below.
Outstanding Contributor.. PerthRM8 Outstanding Contributor..
Outstanding Contributor..

Re: Quick one: AuditLogs, Online ones, do you delete old ones, when?

Thanks Neil, much appreciated.

We are thinking of keeping only logs not older than 3 years ….

- So, delete all ONLINE logs older than December 2016

- Save the Offline logs daily to a Corporate File (Including importing previous year's logs)

- Use the web style App "Logs in TRIM by Sigma Info Proficiency if the users wants to interrogate some older documents using the active audit events/logs. (The problem with this one is that then all other users must have access to this web style LOGS IN TRIM app.....)

Thanks

 

 

 

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.