Auditing time on site collection

Question

We have 18000 site collections, and on site collection creation, auditing was enabled with all options, because at some point auditing logs will need to be checked, probably with an external tool like docAve.

The point here is that this uses lots of data, and 5 of our content dbs are over 100GB already.

When we checked the tables, in every content DB, the audit table is over 30GB. Is there a way to specifiy to sharepoint via powershell or something that the auditing should be kept for a specified number of days? what is the default number of days? or is this data kept forever?

http://screencast.com/t/FvRnR2xX1nbv

Answer 1

Property you are looking for is AuditLogTrimmingRetention

Code snippet to set retention to 30days:

$webapp = Get-SPWebApplication $URL
$auditmask = [Microsoft.SharePoint.SPAuditMaskType]::Delete -bxor   [Microsoft.SharePoint.SPAuditMaskType]::Update -bxor [Microsoft.SharePoint.SPAuditMaskType]::SecurityChange

$webapp.sites | % {
   $_.TrimAuditLog = $true
   $_.Audit.AuditFlags = $auditmask
   $_.Audit.Update()
   $_.AuditLogTrimmingRetention = 30
}

Answer 2

On the site collection where you wish to trim your audit log data, go to:

Site settings > Site collection administration > Site collection audit settings

Set "Automatically trim the audit log for this site" to Yes, this will give you the option the specify the number of days that you wish to retain the audit log data.