Archiving and Purging Audit Data
The DaysOnline parameter of the audit subsystem controls how long audit data remains online. This parameter specifies the number of days that online data should remain in the online storage. The default number of days is 60. If you keep this default value, any data that is older than 60 days is automatically archived to offline storage, based on a scheduler.
The maxEntriesOnlineAuditData parameter of the audit subsystem configuration also controls the maximum number of rows that an audit table can hold. before online data is subject to being archived to offline storage. The default value of this parameter is 500000 rows.
To prevent any system degradation, it is recommended that you archive audit messages automatically at scheduled intervals. These intervals can be daily, weekly, or monthly. It is also recommended that you purge audit data that is no longer needed. As of v.8.5 of ThingWorx platform, archive and purge are separate operations, each with their own scheduler.
Archive Operation
The archive operation moves all audit data from online storage to the offline AuditArchiveFileRepository. By default, the automatic archive operation is set up to run daily. You can change the schedule by changing the configuration of the AuditArchiveScheduler Thing in ThingWorx Composer. To edit the schedule, follow these steps:
1. Assuming that you are logged in to ThingWorx Composer, click 
in the left navigation panel, and then click Things.
in the left navigation panel, and then click Things.2. When you see the list of things, click AuditArchiveScheduler.
3. Click Configuration to display the General Settings, shown here:
4. Set the properties for the AuditArchiveScheduler
◦ runAsUser — This property is set to Administrator by default. This property specifies the user context within which the ScheduledEvent is fired. In addition, subscriptions to that event also run in that user context. It is recommended that you leave it set as is. If you change it, you need to restart the ThingWorx Platform.
◦ schedule — Specifies a cron pattern that defines the schedule for running the archive operation automatically.
◦ enabled — Specifies whether the automatic archive is enabled. Select the check box to enable or disable the automatic archive operation.
5. Click Save.
 | The AuditArchiveScheduler has a property that shows the last run time of a scheduled job, called LastArchivedTime. After every successful run of a scheduled archive job, the system updates this property. Note that although it is possible, this property should NEVER be edited manually. |
When the AuditArchiveScheduler is configured to trigger the archive process daily at a specific time, the audit archive process starts every day, regardless of the outcome of the previous run you do not need to restart Tomcat for the process to run the next day if it fails. If today's archive process does not complete by the next scheduled start time, the system does not stop any executions that are still running. Rather, it waits for that previous execution to complete before starting another one.
Purge Operation
The purge operation deletes audit data based on the configuration of the AuditPurgeScheduler. It deletes entries that are older than the days specified for the DaysOnline parameter. The operation also deletes entries in an audit table whose size exceeds the maximum number of rows specified for the maxEntriesOnlineAuditData parameter of the subsystem. By default, the purge operation is scheduled to run daily at midnight. You can change the schedule, by navigating to and editing the AuditPurgeScheduler . The name of the service is PurgeAuditData.
To edit the schedule:
1. Assuming that you are logged in to ThingWorx Composer, click 
in the left navigation panel, and then click Things.
in the left navigation panel, and then click Things.2. When you see the list of things, click AuditPurgeScheduler.
3. Click Configuration to display the General Settings
4. Set the properties for the AuditPurgeScheduler.
◦ runAsUser — This property is set to Administrator by default. This property specifies the user context within which the ScheduledEvent is fired. In addition, subscriptions to that event also run in that user context. It is recommended that you leave it set as is. If you change it, you need to restart the ThingWorx platform.
◦ schedule — Specifies a cron pattern that defines the schedule for running the purge operation automatically.
◦ enabled — Specifies whether the automatic purge is enabled. Select the check box to enable or disable the automatic purge operation.
5. Click Save.