Active Administrator 8.7 - User Guide

Archiving & purging audit events

Archiving & purging audit events

The audit database can become quite large over time. You should routinely purge and archive events to keep the audit database at a manageable size. If you choose to archive, the data is moved into the archive database.

Purged events are deleted from the live audit database. Archived events are first copied to the archive database and then deleted from the live audit database. You can select different events to purge or archive.

Topics 

•	Archiving events on demand

•	Purging events on demand

•	Setting purge and archive options

•	Scheduling an event log purge and archive

•	Managing the history log

•	Running database maintenance

To archive and purge audit events

1	Select Auditing & Alerting | Archiving and Purging.

The top pane displays the defined audit event archiving and purging schedules.

▪	To switch to the Archive and Purge History page, click History.

▪	To switch back to the Scheduled Audit Event Archiving and Purging page, click Schedule.

The bottom pane displays the maintenance tasks specific to the Purging and Archiving Events feature. See Managing tasks.

2	Use the options on the tool bar to manage purging and archiving.

 

Table 72. Archive and purge tool bar

Option	Description
Archive Now	Archive event entries and alert history items from the live audit database. See Archiving events on demand.
Purge Now	Purge event entries and alert history items from the live audit database. See Purging events on demand.
Refresh	Refresh the display.
Run	Immediately runs the purge and archive based on the properties for the selected schedule. See Scheduling an event log purge and archive. You can monitor the progress in the Tasks area.
Add	Add a new event log purge and archive schedule. See Scheduling an event log purge and archive.
Edit	Edit a selected event log purge and archive schedule. See Scheduling an event log purge and archive.
Delete	Delete selected event log purge and archive schedules.
History	Refresh the history log display, export the history log to a file, or clear the history log display. See Managing the history log.
Tasks	Refresh the task display, view task properties, send a task to email recipients, and group the task display by status. See Managing tasks.
DB Maintenance	Run database maintenance on the audit database. See Running database maintenance.

Archiving events on demand

Archiving events on demand

Copies event entries and alert history items from the live audit database to the active archive database, and then deletes the event entries and alert history from the live audit database. To schedule the archive process, see Scheduling an event log purge and archive.

To archive events on demand

1	Select Auditing & Alerting | Archiving & Purging.

2	Click Archive Now.

3	Type a date or select a date from the calendar.

4	Set options for the archive process, such as choosing to shrink the database, and include or exclude specific events. See Setting purge and archive options.

5	Click Archive Now.

Purging events on demand

Purging events on demand

Deletes event entries and alert history items permanently from the live audit database based on the selected purge options. To schedule the purge process, see Scheduling an event log purge and archive.

To purge events on demand

1	Select Auditing & Alerting | Archiving & Purging.

2	Click Purge Now.

3	Type a date or select a date from the calendar.

4	Set options for the purge process, such as choosing to shrink the database, and include or exclude specific events. See Setting purge and archive options.

5	Click Purge Now.

Setting purge and archive options

Setting purge and archive options

To select specific events to purge or archive, click Purge Options or Archive Options. By default, the database shrinks after the database is purged or archived and the list of event definitions is not filtered. You can choose to include or exclude selected event definitions.

You can access the purge and archive options from the Purge Now, Archive Now, New, or Edit options on the tool bar.

To set options for the event purge archive process

1	Click Purge Options or Archive Options depending on the type you selected.

2	By default, the database shrinks after purging or archiving. Clear the check box if you do not want the database to shrink.

3	You can filter the list of events by typing text in the

4	Filter box. Once you have selected events, you can choose to show All, Selected or Unselected. Active only if Include or Exclude the selected event definitions check boxes are selected.

IMPORTANT: Events selected in Purge Options are deleted first. If the same events are selected in Archive Options, those events are not archived because they were deleted in the purge.

 

Table 73. Event purge/archive options

Option	Description
Do not filter event definitions	By default, all events are purged or archived based on the selected date range.
Include the selected event definitions	Select to specify specific events to purge or archive based on the selected range. Events that are not selected are not purged or archived.
Exclude the selected event definitions	Select to specify specific events to exclude from the database purge or archive. Events that are not selected are purged or archived.

5	Select the events to include or exclude from the purge or archive process.

6

Click OK.