Wednesday, August 6, 2008

Audit data in SharePoint and its impact in DB size

If you are using the SharePoint audit features you need to know which impact have in the size of your DB. A bad audit configuration may cause that the content and SSP database grow permanently.

In the case of a site collection with the audit enabled (http://office.microsoft.com/en-us/sharepointserver/HA100997261033.aspx) you will see the space used by auditing in the table AuditData in the content database. On the other hand, if you are using a BDC application definition and you have defined an entity make sure that in your entity definition sets the audit property properly (http://forums.msdn.microsoft.com/en-US/sharepointbdc/thread/ea208a3b-fd3b-4508-882e-466371c1a53c/).

But if you have enabled auditing for several months is possible that you need to free up space in your disk. In this case the only supported way is through API (very slow solution). For that reason I recommend that review the requirements of your SharePoint solutions and only enable the Sharepoint audit options that are required.

Update: In the Infrastructure Update there is a new stsadm command that allows to trim the logs: stsadm -o trimauditlog –enddate 20080704 –databasename WSSContent123456 (Thanks kezoe)

5 comments:

David Marsh said...
This comment has been removed by the author.
David Marsh said...

Do you know what the percentage of audits vs overall content is or some metrics based on number of audits and how big it makes the databases grow. Also are there any performance impact metrics on CPU and memory utilisation with full auditing switched on. I have a government organisation who needs full auditing switched on but want to know the performance and growth impact to their environment. Any help on this would be great. Thanks.

Àlex said...

David,
It is dependant of different factors:
- Users
- Concurrency and activity
- Audited events (BDC, permissions, reads, writes, ...)

I recommend you to make a estimation monitoring the tables AuditData in content database and AUDEvent in the SSP database.

kezoe said...

"In this case the only supported way is through API (very slow solution)."

I take it you mean by using stsadm? stsadm -o trimauditlog -url url [-enddate]yyyymmdd -databasename (database name> [-databaseserver] database server name

Anonymous said...

Can anyone recommend the top performing Endpoint Security software for a small IT service company like mine? Does anyone use Kaseya.com or GFI.com? How do they compare to these guys I found recently: N-able N-central remote pc software
? What is your best take in cost vs performance among those three? I need a good advice please... Thanks in advance!

 
Online Visitors