UIM audit probe not purging entries older than x days..

Products

• NIMSOFT PROBES
• DX Infrastructure Management

Issue/Introduction

The UIM audit probe has been running fine but we noticed that the AUDIT_CONFIG_CHANGE table has grown excessively large. How can this be corrected. 

Environment

Release:

Component:

Resolution

To resolve: 
deactivate audit probe 
truncate table AUDIT_CONFIG_CHANGE 
truncate table AUDIT_EVENT 
activate audit 

truncate empties the table and so is fast 
delete does a row by row delete and so very slow and will flood the database transaction log

Additional Information

The audit probe tables are: 
AUDIT_CONFIG_CHANGE 
AUDIT_EVENT 
AUDIT_VERSION 

AUDIT_EVENT is maintained by the probe pruning. 

AUDIT_CONFIG_CHANGE does not have timestamp and so not pruned. 

Since AUDIT_CONFIG_CHANGE only has configuration changes it is totally outside normal operations for the table to grown excessively large. 

There is a relationship on the event_id column between the two tables, so both should be truncated.