How to Delete Auditing Data from the SQL Database

Auditing data can be stored in a SQL database. If you are using a SQL Express instance, the maximum database size is restricted to 10GB. If the database is nearing the maximum size limit, you can delete older audit data to create free space.

Complete the following steps on the SQL server hosting the SQL instance used by ArchiveOne:

1. Open SQL Server Management Studio.

2. In the Connect to Server dialog box, enter the SQL instance name used by ArchiveOne, and then click Connect.

   By default, the ArchiveOne instance is named C2CARCHIVEONE. If you are uncertain of the SQL instance used to store auditing data, you can find this from the ArchiveOne Admin console using the following steps:

   On the Archive server, open the ArchiveOne Admin console, right-click the Status node, and click Configure. Click the Advanced Audit tab. The SQL instance is listed in the Database server field.

3. From the Authentication drop-down menu, select Windows Authentication:
   

4. Under the servername, expand Databases, click AOneAudit, and then click New Query:
   
5. First run a SELECT query to confirm you have identified the appropriate data prior to deletion. For example, to select all events before a certain date, e.g., January 2, 2015, and sor the results by date, most recent events first, enter:
   select * from AuditEvent where eventTime < ’2015-01-02′ order by eventTime desc
6. Second run a DELETE query to remove the data. A confirmation message displays with the number of the affected rows. For example, to select all events before a certain date, e.g., January 2, 2015, and sort the results by data, most recent events first, enter:
   delete from AuditEvent where eventTime < ’2015-01-02′
7. Rerun the original SELECT statement to confirm no results are returned and the data has been deleted.