The retention period for audit logs

[iti-attunity-sup]

Hello Support Team.

Please let me know the maximum hours that can be set with the following command:
aemctl.exe audit_trail control [--age hours] [--size megabytes]
It has been confirmed that the maximum value that can be set with this command is "4294967295" hours.

Furthermore, although the retention period in the customer's environment was left as default, we were able to review audit logs for more than one month.
Does this mean that the logs are not deleted once the retention period has passed?

[aarun_arasu]

Hello @iti-attunity-sup ,

Thanks for reaching out to Qlik community

Yes , you are right , the max value can be upto "4294967295"

Have you restarted the service after executing the command ?

You may also try below

aemctl repository export -w -r "C:\Program Files\Attunity\Enterprise Manager\data\cfgrepo.sqlite" -f C:\temp\exportcopty.txt

Open the text file and search for AuditTrail section and verify the values are set as expected

Regards

Arun

[iti-attunity-sup]

Hello Arun,

Thank you for your response.

I tried checking the settings using the command you provided.

The following is the value obtained after a fresh installation.
====
"id": 11,
"path": "/",
"name": "AuditTrail",
"type": "AuditTrail",
"creation_time": 0,
"modification_time": 0,
"inner_item": {
"$type": "AuditTrailDto",
"enabled": true,
"retention": {
"max_backlog_age_hours": 168,
"max_backlog_size_mb": 100,
"limited_retention_age": true
},
====

The following is the value obtained after the change in value.
====
"id": 11,
"path": "/",
"name": "AuditTrail",
"type": "AuditTrail",
"creation_time": 0,
"modification_time": 0,
"inner_item": {
"$type": "AuditTrailDto",
"enabled": true,
"retention": {
"max_backlog_age_hours": 1,
"max_backlog_size_mb": 1,
"limited_retention_age": true
},
====

Please add the following question additionally.
Q1. It appears that the default value in the manual differs from the default value on the actual device. Which one is correct?
Q2. It seems that even when setting "age" to 1, data from one hour ago does not disappear. Could you please inform me of the timing at which it will be deleted?

[DesmondWOO]

Hi @iti-attunity-sup ,

Regarding audit trail retention size and age, I think it is a doc bug. Please create a support ticket. We will verify with R&D.

Regards,
Desmond

[DesmondWOO]

Hi @iti-attunity-sup ,

About the deletion of Audit Trail information, I am checking it and will get back to you after an hour.

Regards,
Desmond

[DesmondWOO · Accepted solution]

Hi @iti-attunity-sup ,

I have set 1 hour but one hour ago information still can be retrieved. Please create a support ticket.

Thanks,
Desmond

[iti-attunity-sup]

Hello Desmond,

Thank you for your support.

I will create a support ticket.