Trimming audit events

Question

We'd enabled all types of audit events for our production web-application and ended up with an issue with DB as auditData table grown to 50GB. Now, we want to reduce the size of the AuditData table.

We already executed stsadm -o trimauditlog and it just helped us to reduce 5GB however stil would like to reduce the size of the table, so thought of deleting all "opening or downloading..." event type entries (now, we disabled the same event). Please let me the best possible way for the same.

also, have you ever faced an issue with DB instance due the size of a table, if so, how did you resolve the issue?

Answer 1

I always recommend that you carefully consider what you want to log and where before enabling audit logs on SharePoint.

This is both due to direct performance impact from logging, and databases / log files growing out of control.

You should consider what you need the data for, and expecially now that you have logged for some time, what parts of the data was used for anything relevant, and adjust the logging accordingly.

Here is a list of the different events you could log. http://msdn.microsoft.com/en-us/library/microsoft.sharepoint.spauditeventtype.aspx

Answer 2

What date did you use to purge date until?

You may want to only keep 2 weeks or a month's worth of audit logging, depending on your business requirement, and upgrade your storage to cope.

How many users has your environment, and over which timescale has it grown to 50GB?