13 July,17 at 09:39 PM
Applies to: Centrify DirectAudit version 2.X on Windows
Question:
How do I check the size of an audited session and delete old sessions?
Answer:
Run the following query on the auditstore in Microsoft SQL Server Management Studio:
SELECT a.machinename,a.starttime,SUM(LEN(b.terminaldata)) AS session_size
FROM session AS a
INNER JOIN rawdata AS b
ON a.sessionid=b.sessionid
GROUP BY a.sessionid,a.machinename,a.starttime
ORDER BY session_size DESC
Once you have sorted the larger sessions you can delete each those session by using the start time as a filter:
Example:
delete from session where starttime='2013-04-29 14:15:44.610'