SP2010: Best Practices to use SPAudit

Question

I would like to use the security audit log report of a site collection, and evaluate the entries e.g. each hour. The focuss lays on actions/events performed on the access rights on the site. Which users are added, deleted, SP groups created, removed etc. This info will be written to a custom list.

Following code can be used to retrieve the events:

SPAuditQuery query = new SPAuditQuery(site);
query.AddEventTrstriction(SPAuditEventType.SecGroupCreate);
query.SetRangeStart(DateTime.Now.AddHours(-1);

SPAuditEntryCollection auditCol = site.Audit.GetEntries(wssQuery);

foreach(SPAuditEntry entry in auditCol)
{
    // Do something with the entries
}

• When I execute this code every hour with e.g. a timer job how can I make sure not to miss entries which fall just on the hour, and are not picked up the next time the timer job is running?
• It's probably advisable to clean up this log file on a regular base using (SPAudit.DeleteEntries)?
• Maybe both points can be combined in one solution e.g. Take the timestamp of the last AuditEntry and delete all entries before this.

Answer 1

Audit logs should be maintained as per capacity planning you have in place (Steve Goldberg gives an example of how to calculate space taken https://www.nothingbutsharepoint.com/sites/itpro/Pages/Best-Practices-for-Auditing-in-SharePoint.aspx).

Only activate it where/when needed and configure trimming as soon (i wouldn't go for an hour as you could have negative impact on the database performance due to high fragmentation and frequent non-important operations) as data is no longer necessary. Another participate in this forum also shared more here How often should the auditing log be cleared to not affect performance?

Data collected is always there unless you trim it, but is as well important to scope appropriately the SPAuditQuery (e.g. Request specific to a list, web, etc. - http://msdn.microsoft.com/en-us/library/microsoft.sharepoint.spauditquery.restricttolist.aspx)