Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

We are building a system that uses SharePoint Auditing in a SharePoint Foundation deployment.

We are wondering about the degradation of performance overtime as the amount of audit information grows.

How often should we clear the auditing log, and how is this done?

share|improve this question
    
Please tag by feature and not by version or product. This helps to attract more attention to your question and keep it relevant. See How do I use tags for general guidelines. Thanks! –  Alex Angas Aug 10 '11 at 4:01
    
@Alex, as functionality can be different per SharePoint version, especially in case of auditing, I think the 'version' tag adds valuable information. –  Muhimbi Aug 10 '11 at 12:51
    
@Muhimbi I meant to move the tag into the body of the question. Thanks for picking this up. –  Alex Angas Aug 10 '11 at 23:00

3 Answers 3

up vote 1 down vote accepted

We have auditing turned on for one of our web applications. Since it can generate a ton of data, we decided to create a separate database within the Sharepoint server. Two times a week, we selectively replicate the data to this other database. This cuts down on the number of items in the log. This allows us to report on the activity going on within the web application but not report on the viewing of CSS and other junk files like Muhimbi mentions.

We can then truncate the audit log without any fear of performance or space issues since the content resides elsewhere. It doesn't really answer any parts of your question, it's more of an anecdotal example of a real world use of auditing.

share|improve this answer

Audting is one of those things that a lot of people just turn on without thinking about how much data can accumulate in a very short amount of time. When I was doing the BLOB remoting thing we would find customers whose audit data was nearly the size of their BLOB data and in some cases more.

So it's one of those features that IMO you should not turn on unless you absolutely need it and only then turn on the events you really want to audit...i.e. have a really good business value reason for turning on "View". Do you need check-in and check-out if you have edit?

As far as controlling audit retention, go to Site Actions > Site Settings > Site collection audit settings (under Site Collection Administration). I personally wouldn't keep more than 30 days.

share|improve this answer
    
Are you sure that's right Rob? I'm not seeing that in Site Settings, I thought the retention was dictated by manually or scripting a trimauditlog command. –  PirateEric Aug 10 '11 at 15:14
    
For 2010, yep. The page is site/_layouts/AuditSettings.aspx –  Rob D'Oria Aug 10 '11 at 15:28
    
Ah ok, I was looking at a 2007 site, very good. The retagging done by Alex probably aided in my confusion. –  PirateEric Aug 10 '11 at 15:30

As one of the developers behind a popular SharePoint Auditing solution, let me share my 2 cents.

Auditing in SharePoint is (deeply) flawed and you are right to be concerned about performance, specifically:

  • Audit logs grow out of control as too much information is logged by default in certain areas, (and too little in other areas). For example requests to .master, .css, .js files and other rubbish you are most likely not interested in.

  • Audit Log files are not truncated automatically and if you want to do it from code it is usually an 'all or nothing' affair. We have seen customers with 100M lines of audit data in a matter of weeks.

  • Because the size of the log data grow out of control it becomes problematic to backup the content databases as that is where all this data is stored.

  • Because the size of the log data grows out of control, it become very difficult to query the logs using SharePoint's own UI, but then you are using SharePoint-Foundation, which provides no UI out of the box.

Some aspects of Auditing, including the various flaws, have been discussed before on this site, have a look at the following questions.

The product I have worked on solves the majority of these problems, so you may want to evaluate that. Obviously I am biased so the usual disclaimers apply.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.