I know each web application has its own
Audit Log Trimming timer job. I see the default is set for it to run monthly.
Now, as you dive into site collection settings for auditing, I see:
Automatically trim the audit log for this site? which gives the option to
Optionally, specify the number of days of audit log data to retain: and you can also specify a document library to store audit reports before trimming.
Here's where the confusion sets in. I saw on some Microsoft page(can't find it right now)where it says that audit trimming isn't enabled at the site collection level then it defaults to using the central admin settings.
I went and looked up how to turn on auditing in central admin and noticed that it's a property of secure store(odd), anyway, in my case it's not turned on but I see the purge occurs every 30 days.
So, how do these all tie in to each other and what is the order of operations?
I found a blog post that stated if you set a number in the
specify the number of days of audit log data to retain to say, something like 7, that you should modify the
Audit Log Trimming timer job to reflect the number selected. So instead of having it run monthly you would have it run every 7 days. This seems counter intuitive because you may have multiple site collections under one web application each with their own unique days to retain value.
Let's say I don't even enable auditing at the farm level. And I don't modify the timer job. How does the trimming work? If I set the number of days to 60 but the timer job is running monthly how exactly is it retaining data longer than 30 days? Is there some sort of flag or calculation that the timer job uses to determine when to trim data from the audit table?
I feel like the logic here should be obvious but the field labeled
If you'd like to keep audit data for longer than this, please specify a document library where we can store audit reports before trimming occurs: is actually an optional field. I am wondering if you don't select a document library then the
optionally, specified ...days is essentially ignored.
Some insight into the process would be greatly appreciated.