I am trying to understand how auditing works in igniton, the data saving is clear but there are some unknowns
Regarding the retention, for example, if it is configured for one day, when will the retention begin? When I save the configuration does it start counting the day?
When will the retention end? at 11:59 pm that day or would it be 24 hours after saving the configuration?
Regarding pruning, should it be enabled to delete data from the main "auditing events" table once the data retention day has passed?
What is the real difference if pruning is enabled or disabled?
I really apologize if my questions are very dull but I really don't fully understand how auditing works, I have carried out tests changing the time and date of the PC and the gateway but the saving of data in the "auditing events" table continues without stall.
I need to retain the data for a week, move that data to a secondary database and have the table emptied and I would like to rely on the same auditing configuration.
Any comments will be appreciated
my ignition version is 8.1.20
With that combination of requirements, I'd simply disable pruning and run a weekly task to move and clear rows as appropriate.
3 Likes
Is there any way I can force the hold to take effect???
Is there any way I can force pruning to see how it works?
I would really like to see how both options work before implementing it due to the delicacy of the data in the real area.
Not sure what you mean. Setting days == 0 disables pruning. Ignition shouldn't delete anything after that. If it does, that's a bug.
Not that I'm aware of.
Do you have backups? Do you have an isolated development environment (including database)? I'd consider both of those as necessities when "delicate data" is involved.
1 Like
The retention and pruning settings go hand in hand. If pruning is turned off, then the retention setting is meaningless as all data will be retained indefinitely.
The idea of pruning is to delete older records (and only those records), so it'll keep saving new records to the table but delete anything that's too old. Anything in the table that's not too old will remain until it gets too old. Unfortunately I don't know the details so I can't tell you exactly how it determines the age or at what time of day the deletion occurs. The safest way to test it is to run a separate gateway on a local PC and see what happens to those audit records with different pruning settings.
Edited to clarify that pruning will only delete some rows as they get too old, not the whole table like you're looking for.
2 Likes
