Change Auditor 7.5 - User Guide

Purging and Archiving your Change Auditor Database

Purging and Archiving your Change Auditor Database

•	Introduction

•	Planning your jobs

•	Purge and Archive page

•	Create and maintain jobs

•	Purge and Archive wizard

•	Purge selected records

Introduction

Introduction

Change Auditor provides several options to schedule both the purging of events from your database and archiving older data to an archive database. Automating database cleanup allows you to keep critical and relevant data online and current while eliminating or archiving events that are no longer required. This not only prevents your database from growing in size, but it increases overall operational efficiency by speeding up searches and data retrieval from the database.

Using the purge options, you can define and schedule jobs that will eliminate events from the database based on the following criteria:

•	All events older than a specific number of days.

•	Selected events based on:

▪	Who - purge events generated by a specific user, computer, group, or service account.

▪	What - purge events based on subsystem, event class, object class, severity or results.

▪	Where - purge events captured by a specific agent, domain or site.

▪	Origin - purge events originating from a specific workstation or server.

Using the archive options, you can select to create a yearly archive database for older events that are no longer required to be represented in your reports.

Table 1. Archive and purge options

Job type	Description
	This deletes events from the production database. You can create and run multiple purge jobs. When scheduling a purge job, you can choose a batch limit. This limit tells the job how many events to delete from the production database before pausing and running another job. Choosing too large of a batch limit may slow your purge jobs down. If you find that they are slow reduce the batch limit.
Archive	This moves events from the production database to an archive database (on the same database server). The archive process removes the events from the production database during the move. Archive events do not need to be purged separately. You can only create and run one “archive” job or one “purge and archive” job. When scheduling an archive job for the first time it may take a long time to complete (depending on how many years of data you are asking to be archived). Batch limit does not apply to an archive type job. When running an archive job, you need to pay attention to disk space growth on the SQL server.
Purge and archive	This deletes events (purge job) from the production database, then immediately performs an archive job to move the remaining records in the time period specified for the job from the production database to an archive database. You can only create and run one “purge and archive” job or one “archive” job. If you select a batch limit, it will only apply to the purging portion of the job. When the batch limit is reached, the job will immediately run again ensuring this job type runs to completion before the archive job begins.

Planning your jobs

Planning your jobs

Planning your jobs before scheduling them will help ensure they run as expected. Keep in mind, all jobs can take a significant time to run depending on the amount of data in your environment.

Scheduling a job

When scheduling your jobs, consider the following:

•	Only one job can run at a time.

•	Only one archive type job (archive only, purge/archive) can exist. However, multiple purge only jobs can be scheduled.

•	Purge only jobs run until they reach the batch limit. When the batch limit is encountered the job pauses (runs again later) to give another job a chance to run. Archive type jobs will not pause to give other jobs the opportunity to run until they are complete.

•	If you have multiple coordinators, only one coordinator will run the job.

•	Use “purge and archive” job to ensure deletion of unwanted events completes before archiving begins.

•	The first time the job is run it may be working with a large amount of data and therefore may take a significant amount of time to run.

•	It is recommended to run jobs frequently so that they are working with less data and complete faster. Start with one job to see how long it takes to complete, then add more jobs as needed.

•

If an archiving job is created to archive large amounts of data over multiple calendar years, it may take a significant amount of time to finish. If you have multiple calendar years of data to archive, select to archive the oldest calendar year first. When the first archive job finishes, update the job settings to archive the next calendar year and so on until all the data has been archived.

•	Enable notification on the purge and archive internal events to monitor job performance.

•

Starting with version 6.9, Change Auditor the Next Run of the reports, archive and purge jobs based on the master time zone. For new deployments, the maser time zone is set to the time zone of the server where the first coordinator is being installed. During an upgrade, the master time zone is set to UTC. You can manually change the master time zone, using the set-CAScheduleMaserTimeZone and get-CAScheduleMasterTimeZone commands. See the Change Audit PowerSell Command User Guide for details.It is recommended to set the master time zone to the time zone where the majority of the users are located.

NOTE: Due to the fact that Daylight Saving Time changes on different dates worldwide, Change Auditors schedules will follow the time change of that specific time zone.

When multiple jobs types are scheduled to run close together the following behavior will occur:

•	A list of jobs is created and ordered by next run time. If two jobs have the same run time the archive type will run first.

NOTE: Because of this the “purge” jobs may not complete before the “archive” or “purge and archive” jobs run if you do not plan properly.

•	Multiple “Purge” jobs will be run based on the next run time order.

•	The “purge” job type runs until the batch limit is reached (batch limit is the total number of events to delete) and then pauses to give another “purge” job a chance to run.

During a job

During a purge and/or archive job, consider the following:

•	Use internal events to monitor job performance .

•	Monitor disk space on the SQL server while archiving is in progress. (No Shrink is performed)

Post job considerations

After the purge and/or archive job completes, consider the following:

•	The physical database size is not changed. (Shrink operation is not performed). Once the archive database has been created, you should perform a database cleanup (shrink) on the production database as required to free up disk space.

For information on how to perform a database shrink, see https://msdn.microsoft.com/en-us/library/ms189035.aspx.

•	Multiple archive databases may be created (1 database per archived year).

•	Archive databases for previous years can be detached and moved to a backup storage if needed.

Purge and Archive page

Purge and Archive page

The Purge and Archive page is displayed when Purge and Archive is selected from the Configuration task list in the navigation pane of the Administration Tasks page. From here you can specify the settings for the purge and archive jobs.

Before creating your jobs, ensure that you have reviewed Planning your jobs.

Once a job is defined, the page displays the following details:

Table 2. Purge and Archive page: Field descriptions

Column	Description
Job Name	Displays the name assigned to the job when it was created using the Purge and Archive wizard.
Last Run	Displays the date and time the job last ran. NOTE: Based on the client’s current local date and time. The format used to display this date and time is determined by the local computer’s regional and language setting.
Next Run	Displays the date and time the job is scheduled to run next. NOTE: Based on the client’s current local date and time. The format used to display this date and time is determined by the local computer’s regional and language setting.
Status	Indicates whether the job is enabled or disabled.
Schedule	Displays the schedule defined for running the job.

You will also see information regarding the status of reach job including:

•	When the job was run.

•	The duration of the job.

•	The number of events processed.

•	The coordinator involved in the process.

•	Informational messages as to the status if the job:

Immediately continuing job: Displays when the purge portion of a ‘purge and archive’ job continues.

Archive database not found. Recreating archive database: Displays if an archive database has been moved or deleted.

Starting job: Displays when the purge, archive, or purge and archive job is beginning.

Successfully finished job: Displays when the purge and archive, purge, or archive job is finished.

New archive database created: Displays when the new archive database has been created for the calendar year.

Events archived: Displays the progression of the number of events being archived.

Total events archived: Displays the total number of archived events when archiving is finished.

Continue purge job: Displays when re-queued purge jobs run again.