When either Discovery or an interactive Web Part analysis is run, document libraries are searched for Web Part Pages from which Web Parts are collected. Because this can be a resource-intensive process, by default only document libraries that have 50 items or fewer are searched. ControlPoint Application Administrators can, however, specify a different threshold by changing the Value of the ControlPoint Setting Maximum Size of Library in Which to Search for Web Part Pages.
Note that, at a higher threshold, more Web Part Pages will be searched, but the process will become more resource-intensive.
NOTE: If you want to include all document libraries in your search, regardless of size, set the threshold to 0.
These configuration settings display in the ControlPoint Settings list under the category Audit Log.
For settings in this category that apply to ControlPoint Sentinel for Anomalous Activity Detection, see Changing Settings for Aomalous Activity Detection.
The following three settings are exclusive to ControlPoint Archive Audit Log Data processing:
·Archive Audit Log Table Connection String
·Web Applications to Include in Audit Logs
·Number of Hours Worth of Data to Archive at One Time.
For information on using these configuration settings within the context of audit log data archiving, see Archiving SharePoint Audit Log Data.
When auditing is enabled for a SharePoint site collection (either from within SharePoint or using the ControlPoint Set Site Collection Properties feature), SharePoint keeps records of audited actions and events in the content database(s). It is from this history that ControlPoint Audit Log analyses can be run.
ControlPoint provides an option to purge audit data so that content databases are not overloaded. By default, no purging is done (as indicated by a Value of 0). ControlPoint Application Administrators can change this retention period by modifying the Value for the ControlPoint Setting Number of Days to Keep Audit Records (AUDITMAXDAYS).
Audit history is purged up to the number of days specified by the ControlPoint Discovery process
If the default Value is kept, the audit records will never be purged. Keep in mind however, the longer audit history is retained, the more storage space it will use in content databases. Alternatively, you can archive audit log data to free up storage space using ControlPoint xcUtilities. See Archiving SharePoint Audit Log Data.
Tips for Archiving a Large Accumulation of Audit Data
If you have many months or even years' worth of accumulated data to purge, doing all of it in a single operation can be resource-intensive and can perform slowly. It is recommended, therefore, that you initially set AUDITMAXDAYS to a larger number, then incrementally reduce that number before each subsequent Discovery run until you have reached the number of days' worth that you want to retain on an ongoing basis.
Suppose 1,000 days' worth of audit log data has accumulated on your farm, but going forward you only want to retain 60 days' worth. Depending on the size of your farm, purging 940 days worth of data in a single operation might significantly slow down the Discovery job. To avoid this problem, you may want to initially set the AUDITMAXDAYS Value to 800 (that is, purge 200 days' worth) of audit log data. After the Discovery job has completed, you may want to bring the number down to 600 (that is, purge another 200 or so days' worth), and so on, until you have reduced the amount of audit log data in the database to a manageable amount. You can then set and leave the Value at 60, saving only the amount that you want to retain on an ongoing basis.