Wednesday 31 October 2012

Deleting SharePoint AuditData

As most we have a auditing requirements for when we need to do forensic excercises.  Unfortunatly we turned auditing on with no real thought.  We are now in the situation that we have hundreds of millions of rows of AuditData.  We have attempted to delete this data using the standard powershell methods (SPSite.Audit.DeleteEntries(SomeDate), however we have found this method causes outages as is causing locks at the database.  We have attempted deleting a tiny amount of data (last hour) this does not cause database locks but it would take a year to delete all data.

We have been in contact with Microsoft Premier support and they have given us approval to Truncate the AuditData table, which will save our problems.  You must contact premier support to get specific approval your self or your SharePoint environment will be un-supported.  Below is a script that will backup the database and Truncate the AuditData table for you. 

It goes with out saying but make sure you test this in a non-production enviornment!

DECLARE @DatabaseName VARCHAR(254)
DECLARE @Path VARCHAR(1000)
DECLARE @Truncate VARCHAR(1000)

SET @DatabaseName = 'SP_PP'
SET @Path = 'C:\Program Files\Microsoft SQL Server\MSSQL10_50.SP2010\MSSQL\Backup\'
SET @Truncate = 'TRUNCATE TABLE AuditData'

--Configure Path
IF (SUBSTRING(@Path, LEN(@Path), 1) != '\')
BEGIN
 SET @Path += '\'
END
SET @Path += @DatabaseName + '-Truncate.bak'

--Backup Database
BEGIN TRY
 BACKUP DATABASE @DatabaseName TO  DISK = @Path WITH NOFORMAT,
 NOINIT, 
 NAME = N'TODEL-Full Database Backup', SKIP, NOREWIND, NOUNLOAD,  STATS = 10
 PRINT 'Backup has Completed'
END TRY
BEGIN CATCH
 PRINT 'Backup Failed Stopping.................'
 RETURN            
END CATCH
BEGIN TRY
 EXEC ('USE [' + @DatabaseName + '] ; EXEC sp_executesql N''' + @Truncate +'''')
 PRINT 'Truncate Success'               
END TRY
BEGIN CATCH
 PRINT 'Truncate Failed........................'               
END CATCH

No comments:

Post a Comment