Applies to: Centrify DirectAudit version 2.X on Windows



Question:
How do I check the size of an audited session and delete old sessions?



Answer:
Run the following query on the auditstore in Microsoft SQL Server Management Studio:

SELECT a.machinename,a.starttime,SUM(LEN(b.terminaldata)) AS session_size
FROM session AS a
INNER JOIN rawdata AS b
ON a.sessionid=b.sessionid
GROUP BY a.sessionid,a.machinename,a.starttime
ORDER BY session_size DESC

Once you have sorted the larger sessions you can delete each those session by using the start time as a filter:

Example: 
delete from session where starttime='2013-04-29 14:15:44.610'