Chat now with support
Chat with Support

Change Auditor 7.3 - User Guide

Change Auditor Overview Agent Deployment Change Auditor Client Overview Overview Page Searches Search Results and Event Details Custom Searches and Search Properties Enable Alert Notifications Administration Tasks Agent Configurations Coordinator Configuration Purging and Archiving your Change Auditor Database Disable Private Alerts and Reports Generate and Schedule Reports SQL Reporting Services Configuration Change Auditor User Interface Authorization Client Authentication Certificate authentication for client coordinator communication Integrating with On Demand Audit Enable/Disable Event Auditing Account Exclusion Registry Auditing Service Auditing Agent Statistics and Logs Coordinator Statistics and Logs Change Auditor Commands Change Auditor Email Tags

Introduction

Change Auditor provides several options to schedule both the purging of events from your database and archiving older data to an archive database. Automating database cleanup allows you to keep critical and relevant data online and current while eliminating or archiving events that are no longer required. This not only prevents your database from growing in size, but it increases overall operational efficiency by speeding up searches and data retrieval from the database.

Using the purge options, you can define and schedule jobs that will eliminate events from the database based on the following criteria:

•
All events older than a specific number of days.
•
Selected events based on:
•
Who - purge events generated by a specific user, computer or group.
•
What - purge events based on subsystem, event class, object class, severity or results.
•
Where - purge events captured by a specific agent, domain or site.
•
Origin - purge events originating from a specific workstation or server.

Using the archive options, you can select to create a yearly archive database for older events that are no longer required to be represented in your reports.

Table 1. Archive and purge options
Job type
Description

 

This deletes events from the production database. You can create and run multiple purge jobs.

When scheduling a purge job, you can choose a batch limit. This limit tells the job how many events to delete from the production database before pausing and running another job. Choosing too large of a batch limit may slow your purge jobs down. If you find that they are slow reduce the batch limit.

Archive

This moves events from the production database to an archive database (on the same database server). The archive process removes the events from the production database during the move. Archive events do not need to be purged separately. You can only create and run one “archive” job or one “purge and archive” job.

When scheduling an archive job for the first time it may take a long time to complete (depending on how many years of data you are asking to be archived). Batch limit does not apply to an archive type job.

When running an archive job, you need to pay attention to disk space growth on the SQL server.

Purge and archive

This deletes events (purge job) from the production database, then immediately performs an archive job to move the remaining records in the time period specified for the job from the production database to an archive database. You can only create and run one “purge and archive” job or one “archive” job.

If you select a batch limit, it will only apply to the purging portion of the job. When the batch limit is reached, the job will immediately run again ensuring this job type runs to completion before the archive job begins.

Planning your jobs

Planning your jobs

Planning your jobs before scheduling them will help ensure they run as expected. Keep in mind, all jobs can take a significant time to run depending on the amount of data in your environment.

Scheduling a job

When scheduling your jobs, consider the following:

•
Only one job can run at a time.
•
Only one archive type job (archive only, purge/archive) can exist. However, multiple purge only jobs can be scheduled.
•
Purge only jobs run until they reach the batch limit. When the batch limit is encountered the job pauses (runs again later) to give another job a chance to run. Archive type jobs will not pause to give other jobs the opportunity to run until they are complete.
•
If you have multiple coordinators, only one coordinator will run the job.
•
Use “purge and archive” job to ensure deletion of unwanted events completes before archiving begins.
•
The first time the job is run it may be working with a large amount of data and therefore may take a significant amount of time to run.
•
It is recommended to run jobs frequently so that they are working with less data and complete faster. Start with one job to see how long it takes to complete, then add more jobs as needed.
•
If an archiving job is created to archive large amounts of data over multiple calendar years, it may take a significant amount of time to finish. If you have multiple calendar years of data to archive, select to archive the oldest calendar year first. When the first archive job finishes, update the job settings to archive the next calendar year and so on until all the data has been archived.
•
Enable notification on the purge and archive internal events to monitor job performance.
•
Starting with version 6.9, Change Auditor the Next Run of the reports, archive and purge jobs based on the master time zone. For new deployments, the maser time zone is set to the time zone of the server where the first coordinator is being installed. During an upgrade, the master time zone is set to UTC. You can manually change the master time zone, using the set-CAScheduleMaserTimeZone and get-CAScheduleMasterTimeZone commands. See the Change Audit PowerSell Command User Guide for details.It is recommended to set the master time zone to the time zone where the majority of the users are located.
* 
NOTE: Due to the fact that Daylight Saving Time changes on different dates worldwide, Change Auditors schedules will follow the time change of that specific time zone.

When multiple jobs types are scheduled to run close together the following behavior will occur:

•
A list of jobs is created and ordered by next run time. If two jobs have the same run time the archive type will run first.
* 
NOTE: Because of this the “purge” jobs may not complete before the “archive” or “purge and archive” jobs run if you do not plan properly.
•
Multiple “Purge” jobs will be run based on the next run time order.
•
The “purge” job type runs until the batch limit is reached (batch limit is the total number of events to delete) and then pauses to give another “purge” job a chance to run.
During a job

During a purge and/or archive job, consider the following:

•
Use internal events to monitor job performance .
•
Monitor disk space on the SQL server while archiving is in progress. (No Shrink is performed)
Post job considerations

After the purge and/or archive job completes, consider the following:

•
The physical database size is not changed. (Shrink operation is not performed). Once the archive database has been created, you should perform a database cleanup (shrink) on the production database as required to free up disk space.
For information on how to perform a database shrink, see https://msdn.microsoft.com/en-us/library/ms189035.aspx.
•
Multiple archive databases may be created (1 database per archived year).
•
Archive databases for previous years can be detached and moved to a backup storage if needed.

Purge and Archive page

The Purge and Archive page is displayed when Purge and Archive is selected from the Configuration task list in the navigation pane of the Administration Tasks page. From here you can specify the settings for the purge and archive jobs.

Before creating your jobs, ensure that you have reviewed Planning your jobs.

Once a job is defined, the page displays the following details:

Table 2. Purge and Archive page: Field descriptions
Column
Description

Job Name

Displays the name assigned to the job when it was created using the Purge and Archive wizard.

Last Run

Displays the date and time the job last ran.

NOTE: Based on the client’s current local date and time. The format used to display this date and time is determined by the local computer’s regional and language setting.

Next Run

Displays the date and time the job is scheduled to run next.

NOTE: Based on the client’s current local date and time. The format used to display this date and time is determined by the local computer’s regional and language setting.

Status

Indicates whether the job is enabled or disabled.

Schedule

Displays the schedule defined for running the job.

You will also see information regarding the status of reach job including:

•
When the job was run.
•
The duration of the job.
•
The number of events processed.
•
The coordinator involved in the process.
•
Informational messages as to the status if the job:
Immediately continuing job: Displays when the purge portion of a ‘purge and archive’ job continues.
Archive database not found. Recreating archive database: Displays if an archive database has been moved or deleted.
Starting job: Displays when the purge, archive, or purge and archive job is beginning.
Successfully finished job: Displays when the purge and archive, purge, or archive job is finished.
New archive database created: Displays when the new archive database has been created for the calendar year.
Events archived: Displays the progression of the number of events being archived.
Total events archived: Displays the total number of archived events when archiving is finished.
Continue purge job: Displays when re-queued purge jobs run again.

Create and maintain jobs

In addition to viewing the details about previously defined jobs, use the Purge and Archive page to define and schedule new jobs, and edit, disable/enable or delete existing jobs.

* 
CAUTION: Carefully review your current jobs before creating a new job or altering an existing job, as it is possible to create purge and archive conflicts.
* 
NOTE: If you have specific purge jobs that you want to complete before a scheduled archive, ensure that you leave enough time between the purge only jobs and the archive job.

Before scheduling a job, ensure that you have reviewed the best practice information in Planning your jobs.

To schedule a purge and archive job:
1
Open the Administration Tasks tab and select Configuration | Purge and Archive.
2
Click Add to open the Purge and Archive wizard.
3
Enter a descriptive job name.
4
Select the data that you want to purge and/or archive. The default is to process events older than 90 days.
* 
NOTE: Jobs created in previous versions will have the process time converted from weeks/months/quarters/years to the appropriate number of days.
5
If required, select Purge and choose the records to be deleted from the production database.
All events: Select this option to purge all events from the database that are older than the specified time.
Only selected events: Select this option to purge only selected events, based on specific criteria, from the database that are older than the specified time.
Use the criteria tabs to define the events to be deleted:
Who - purge events generated by a specific user, computer or group.
What - purge events based on subsystem, event class, object class, severity or results.
Where - purge events captured by a specific agent, domain or site.
Origin - purge events originating from a specific workstation or server.
See Purge selected records for a description of the criteria options.
* 
NOTE: If you specify criteria on more than one tab, the criteria specified on ALL of the tabs must be met before an event is deleted from the database or archived.
6
Select Archive events if you want to create an archive database. A yearly archive database will be created beginning on the first day of the selected month. For example, if you select Jan, the database will contain events for 12 months beginning on January 1.
If you have also selected to purge events based on specific criteria, any events that remain will be moved to the archive database.
* 
NOTE: A new archive database will be created for each year of events that you have in your production database.
NOTE: This option is not available, if there is an existing archive job.
7
Click Next.
8
Select the job scheduling options to define when the events are to be deleted or archived.
9
Click Finish to save the job and exit the wizard.
To edit a scheduled purge and archive job:
1
On the Purge and Archive page, select the job to be edited.
2
Click Edit to open the Purge and Archive wizard.
3
Modify the current settings as necessary.
4
Click Finish to save your selections and exit the wizard.
To disable a scheduled purge and archive job:
1
On the Purge and Archive page, select the job to be disabled, right-click and select Disable.
When a job is disabled, that particular database cleanup job will not take place until it is re-enabled.
2
To enable a previously disabled job, select the job from the Purge and Archive page, right-click and select Enable.
To delete a scheduled purge and archive job:
1
On the Purge and Archive page, select one or more jobs from the list and click Delete.
2
When prompted, confirm that you want to delete the scheduled jobs.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating