UIM audit probe not purging entries older than x days..
Article ID: 106206
Updated On:
Products
NIMSOFT PROBES
DX Infrastructure Management
Issue/Introduction
The UIM audit probe has been running fine but we noticed that the AUDIT_CONFIG_CHANGE table has grown excessively large. How can this be corrected.
Environment
Release:
Component:
Resolution
To resolve:
deactivate audit probe
truncate table AUDIT_CONFIG_CHANGE
truncate table AUDIT_EVENT
activate audit
truncate empties the table and so is fast
delete does a row by row delete and so very slow and will flood the database transaction log
deactivate audit probe
truncate table AUDIT_CONFIG_CHANGE
truncate table AUDIT_EVENT
activate audit
truncate empties the table and so is fast
delete does a row by row delete and so very slow and will flood the database transaction log
Additional Information
The audit probe tables are:
AUDIT_CONFIG_CHANGE
AUDIT_EVENT
AUDIT_VERSION
AUDIT_EVENT is maintained by the probe pruning.
AUDIT_CONFIG_CHANGE does not have timestamp and so not pruned.
Since AUDIT_CONFIG_CHANGE only has configuration changes it is totally outside normal operations for the table to grown excessively large.
There is a relationship on the event_id column between the two tables, so both should be truncated.
AUDIT_CONFIG_CHANGE
AUDIT_EVENT
AUDIT_VERSION
AUDIT_EVENT is maintained by the probe pruning.
AUDIT_CONFIG_CHANGE does not have timestamp and so not pruned.
Since AUDIT_CONFIG_CHANGE only has configuration changes it is totally outside normal operations for the table to grown excessively large.
There is a relationship on the event_id column between the two tables, so both should be truncated.
Feedback
Powered by
