The enable audit setting in Central admin has "days until purge". Suppose if I set this to 60 days what happens after 60 days?
All audits that are older than 60 days will not be shown in the Audit report.
If I set the above setting and don't enable auditing in the site collection, I don't get audit reports. Correct?
Yes, it's correct! The Audit is now enabled but you should
Specify the events to audit on the site collection to get the Audit Report for these events!
With 60 days purge setting in CA, if I enable auditing in the site collection by enabling trimming & storing the audit log for 30 days. Does the audit reports are deleted after 30 days?
Yes, all audits that are older than 30 days will not be available.
If you enabled
Audit Log Trimming in Audit settings of the Site collection, the value of
specify the number of days of audit log data to retain will overwrite the default value in Central Admin.
Can I pull the data in custom report for more than 30 days or not?
No, because you have already enabled the
Audit Log Trimming! but optionally you can archive the current audit log data in a document library before the data is trimmed. The schedule for
audit log trimming is configured Monthly in Central Administration and you can change it at
- Monitoring > Review Job definitions > Audit Log Trimming.
How are these two settings connected if at all?
The value that set in the
Secure store service properties for
Enable Audit is the default value in case you have not enabled the
Audit Log Trimming in the site collection.
Note: It's recommended to Automatically trim the audit log for
site collections to avoid the performance issue on all the
farm and to prevent the audit log from filling the hard drive. it's the main goal of
Audit Log Trimming