Trimauditlog: Stsadm operation (Windows SharePoint Services)
Updated: June 18, 2009
Applies To: Windows SharePoint Services 3.0
Operation name: Trimauditlog
Lets an administrator delete audit entries older than a certain date, as specified by using the date parameter.
This operation is available after the Infrastructure Update for Windows SharePoint Services 3.0 is installed. This functionality is available only by using Stsadm.
stsadm -o trimauditlog
-url <URL name>
-databasename <database name>
[-databaseserver] <database server name>
A valid URL, such as http://server_name
Yes, if databasename parameter is not specified
Specifies the URL name to a site collection. If you use this parameter, it will only delete the audit entries from that site collection. If this parameter is used, the databaseserver and databasename parameters are ignored.
A valid date in the form "YYYYMMDD"
Represents the earliest date and time for which the user wants to preserve audit data.
A valid database name, such as "DB1"
Yes, if url parameter is not specifed
Specifies the name of a content database where the audit log should be trimmed.
A valid database server, such as "DS1"
Name of the database server where the content database is stored.
For situations in which you want to provide additional parameters beside a date to delete audit entries, see SPAudit.DeleteEntries Method (Microsoft.SharePoint) (http://go.microsoft.com/fwlink/?LinkId=121892&clcid=0x409).
If you want to export the current log before deleting it, custom code can be written using the SPAudit Class (Microsoft.SharePoint) (http://go.microsoft.com/fwlink/?LinkID=121893&clcid=0x409).
The audit entries are permanently deleted after this operation has run.
An administrator can use Windows Task Scheduling to set this trim job to reoccur according to a defined period. For additional information about Windows Scheduling, see SharePoint Timer Job Reference (Office SharePoint Server).
Your audit log is growing too fast and you want to trim some entries from it. To specify a date of July 4, 2008, and the content database name WSSContent123456, you would use the following syntax:
stsadm -o trimauditlog –date 20080704 –databasename WSSContent123456