Audit Archive, Purge, and Cleanup Operations
The audit subsystem provides both online and offline storage for audit messages:
• Online—Individual entries are displayed online and are searchable using the QueryAuditHistory and QueryAuditHistoryWithQueryCriteria services of the audit subsystem.
• Offline—In the context of the audit subsystem, “offline” means that audit data is not available to be retrieved and seen in ThingWorx Composer, nor can it be retrieved using the QueryAuditHistory and QueryAuditHistoryWithQueryCriteria services. The data is archived in files that are stored in the file repository of the audit subsystem, called AuditArchiveFileRepository. It is possible to export these files from the repository. Permissions to this repository can be set to restrict access to the data. The data is exported in JSON format, localized, and compressed.
Services to Control the Volume of Audit Data
To maintain a controlled amount of online data and maintain performance while searching and filtering online audit data, the audit subsystem provides ArchiveAuditHistory, ArchiveAuditHistoryDirectPersistence, and PurgeAuditData services for online data. The running of these services can be scheduled or you can run them manually. To reduce the amount of offline audit data, use the CleaupAuditData service. For more information about archive and purge operations, see .Archiving and Purging Online Audit Data (Direct Persistence) or Archiving and Purging Online Audit Data (Data Table). For more information about the cleanup service, refer to Clean-up of the Offline Audit Archives
Reviewing Audit Data
To allow administrators to monitor activities when troubleshooting or examining activity for purposes of reporting, the audit subsystem also provides export services for both online and offline data. Each export service pushes the requested data to a target destination and localizes the data.
For the Direct Persistence implementation, it is recommended to use the ExportOnlineAuditData service. For offline audit data, use the ExportAuditData service. Both services read the audit data out to a file and localize it.
For the Data Table implementation, only the ExportAuditData service is available. Use it to read online and offline audit data out to a file and localize it.
The ExportAuditData and ExportOnlineAuditData services run the archive service first. Neither the export nor the archive services delete any messages from the online audit data store, so no performance improvement occurs after running them. However, you can improve query performance by running the PurgeAuditData service on online audit data. The purge and export services call the archive service first. In case of purge. this call is made to ensure that all data that is to be deleted from online storage is copied to the offline storage first. For more information about the export services, refer to Exporting Online Audit Data (Direct Persistence only) and Exporting Audit Data (both implementations).
When to Run the Services
Depending on which implementation of the Audit Subsystem you are using, the Archive and Purge services and the actions they perform differ. Follow the link for the implementation you selected:
To prevent any system degradation, it is recommended that you archive online audit messages automatically at scheduled intervals. It is also recommended that you purge online audit data that is no longer needed.
 |
If you have been using an earlier version of ThingWorx Platform with the original Data Table implementation (v.8.2.x through 8.4.x), keep in mind that, as of v.8.5 of the ThingWorx Platform, archive and purge are separate operations, each with their own scheduler.
|