UIM audit probe not purging entries older than x days..
Article ID: 106206
DX Infrastructure Management
The UIM audit probe has been running fine but we noticed that the AUDIT_CONFIG_CHANGE table has grown excessively large. How can this be corrected.
deactivate audit probe
truncate table AUDIT_CONFIG_CHANGE
truncate table AUDIT_EVENT
truncate empties the table and so is fast
delete does a row by row delete and so very slow and will flood the database transaction log
The audit probe tables are:
AUDIT_EVENT is maintained by the probe pruning.
AUDIT_CONFIG_CHANGE does not have timestamp and so not pruned.
Since AUDIT_CONFIG_CHANGE only has configuration changes it is totally outside normal operations for the table to grown excessively large.
There is a relationship on the event_id column between the two tables, so both should be truncated.