ControlPoint 8.7 - User Guide

Number of Days to Keep Audit Records (AUDITMAXDAYS)

When auditing is enabled for a SharePoint site collection (either from within SharePoint or using the ControlPoint Set Site Collection Properties feature), SharePoint keeps records of audited actions and events in the content database(s). It is from this history that ControlPoint Audit Log analyses can be run.  

ControlPoint provides an option to purge audit data so that content databases are not overloaded.  By default, no purging is done (as indicated by a Value of 0). ControlPoint Application Administrators can change this retention period by modifying the Value for the ControlPoint Setting Number of Days to Keep Audit Records (AUDITMAXDAYS).

Audit history is purged up to the number of days specified by the ControlPoint Discovery process

If the default Value is kept, the audit records will never be purged.  Keep in mind however, the longer audit history is retained, the more storage space it will use in content databases.  Alternatively, you can archive audit log data to free up storage space using ControlPoint xcUtilities.  See Archiving SharePoint Audit Log Data.

Tips for Archiving a Large Accumulation of Audit Data

If you have many months or even years' worth of accumulated data to purge, doing all of it in a single operation can be resource-intensive and can perform slowly.   It is recommended, therefore, that you initially set AUDITMAXDAYS to a larger number, then incrementally reduce that number before each subsequent Discovery run until you have reached the number of days' worth that you want to retain on an ongoing basis.

EXAMPLE:

Suppose 1,000 days' worth of audit log data has accumulated on your farm, but going forward you only want to retain 60 days' worth.  Depending on the size of your farm, purging 940 days worth of data in a single operation might significantly slow down the Discovery job. To avoid this problem, you may want to initially set the AUDITMAXDAYS Value to 800 (that is, purge 200 days' worth) of audit log data.  After the Discovery job has completed, you may want to bring the number down to 600 (that is, purge another 200 or so days' worth), and so on, until you have reduced the amount of audit log data in the database to a manageable amount.  You can then set and leave the Value at 60, saving only the amount that you want to retain on an ongoing basis.