UIM audit probe not purging entries older than x days..
book
Article ID: 106206
calendar_today
Updated On:
Products
DX Unified Infrastructure Management (Nimsoft / UIM)
Issue/Introduction
The UIM audit probe has been running fine but we noticed that the AUDIT_CONFIG_CHANGE table has grown excessively large. How can this be corrected.
Resolution
To resolve:
deactivate audit probe
truncate table AUDIT_CONFIG_CHANGE
truncate table AUDIT_EVENT
activate audit
truncate empties the table and so is fast
delete does a row by row delete and so very slow and will flood the database transaction log
Additional Information
The audit probe tables are:
AUDIT_CONFIG_CHANGE
AUDIT_EVENT
AUDIT_VERSION
AUDIT_EVENT is maintained by the probe pruning.
AUDIT_CONFIG_CHANGE does not have timestamp and so not pruned.
Since AUDIT_CONFIG_CHANGE only has configuration changes it is totally outside normal operations for the table to grown excessively large.
There is a relationship on the event_id column between the two tables, so both should be truncated.
Feedback
thumb_up
Yes
thumb_down
No