Applies to: Versions of DirectAudit >=2.x on all supported platforms
Problem: After rolling back a SQL database to a previous state, the PurgeSessions tool is no longer able to find sessions to delete even though there are sessions matching the criteria specified by the PurgeSessions tool. Please refer to
KB-3394: Is it possible to purge audit sessions older than 'x' number of days for how to use the tool.
Cause: After a rollback, the old sessions may become stuck in terminated state with no end time. This state is excluded by the PurgeSessions tool by design.
Resolution:Use the attached SQL script to delete sessions that are in terminated, disconnected, or completed state and are older than x number of days. Default is set to 365 days. Please modify the value on line #9 as needed. This script is to be run against the target
audit store database as a DBA.