After the configured number of days have passed, older audit records are removed from the MAP_EVENT_AUDIT table. Records in this table can be accessed through the SQL Server Query Analyzer or through CLUI. If the site does not require records to be stored past the configured number of days, for example, if the site has another audit management system to store auditing information, the records are deleted without further action. If the site requires that the audit records be maintained for a longer length of time, MVF Task Scheduler can be configured to export the records to text files before removing them from the database. The site can then store those files as required.
You can control the timing of events through the following tables:
| Table | Field | Specifies |
|---|---|---|
| MVF_TS_MODULE_CONFIG | MAP_EVENT_AUDIT_DAYS | The number of days older audit records are kept in the MAP_EVENT_AUDIT table. By default, records are kept for 60 days. |
| MVF_TS_CONFIG | CLEAN_MAP_EVENT_AUDIT | How often event records are removed from the MAP_EVENT_AUDIT table. By default, expired records are deleted every Saturday beginning at 3 A.M. |
Audit record workflow
At the specified times, MVF Task Scheduler deletes all records from the MAP_EVENT_AUDIT table except those whose date_time_created falls within the start of the current day minus MAP_EVENT_AUDIT_DAYS.
For example, if MAP_EVENT_AUDIT_DAYS is 14 and the MVF Task Scheduler cleanup schedule falls on January 15, all records before January 1 are deleted from the MAP_EVENT_AUDIT table.
When MVF Task Scheduler has finished exporting records and/or deleting records from the MAP_EVENT_AUDIT table, an event is recorded in the MAP_EVENT table with an event_type of EVENTS_AUDITED or EVENTS_DELETED.
Note:
By default, records are kept in the MAP_EVENT_AUDIT table for 60 days but MVF Task Scheduler only attempts to delete older records from this table every Saturday beginning at 3 A.M. This means that, depending on the day, the MAP_EVENT_AUDIT table may contain more than 60 days of records.
If MVF Task Scheduler is configured to export audit records to a file, it attempts to export the records to a single file.
If MVF Task Scheduler fails during the export process or if more events arrive after the day was processed, a second file is created with the same name as the first file but with a .date_time extension.