How to trim Audit Logs in SharePoint 2007&2010

Auditing enables administrators to keep a reliable log of what is happening with important content on a site collection. Administrators are able to retrieve the entire history of actions taken by a particular user and can also retrieve the entire history of actions taken during a particular date range.In SharePoint Content Database we have a table named  AuditData. This table  stores audit logs when “Auditing” enabled in Site or List Libraries. But once you enabled “Auditing” this table size will growth continously and  it will consume your storage space in your SQL Server quickly.At that point you’ll need to delete older audit logs which is stored in your content database

For SharePoint 2007 we have a STSADM command for clearing audit data for maintanence purporse (but it is depreciated in SharePoint 2010)

So clearing old auditlogs you may fallow

1)      Open a Command Prompt as Administrator Privilegdes in your one of SharePoint Server
2)      Change path to
cd c:\program files\common files\microsoft shared\web server extensions\12\Bin
3)  Run fallowing command change it as your content database name
stsadm –o trimauditlog –date 20120822 –databasename MyContentDatabaseName
Important: The audit entries before given date are permanently deleted after this operation has run

This operation is not done automatically by SharePoint 2007 (it is by design) .This responsibility has assigned to System Administrators for maintenance and shoud be done manually by periodically.For more information about trimauditlog you can check:

For SharePoint 2010  we have a dedicated TimerJob for doing this operation .Default schedule is set by monthly.

1)      Go to your Central Administration -> Monitoring -> Review Job definitions

2)      You can see in picture every site has own Audit Log Trimming Job. Select correct job for your actual site
3)      Click “Run Now” button.

I would like to inform you about someting when you run this timer job it will use the value of retention (for example 3 )  which you set in Site Settings-> Site Collection Audit Settings .
Even you set the “Automatically trim the audit log for this site” yes and set retention for 3 days (like in example) . the logs will not be deleted from Content Database until “Audit Log Trimming” timer job is run.After timer job runs the logs until retention value ( 3 days in example) will be deleted.

What if you set “Automatically trim the audit log for this site” as No . How could you clear old logs ?

There is another way to do it by using PowerShell . you can able to give here a date as parameter like stsadm command.

1)      Run SharePoint 2010 Powershell Console by administrator priviledges .
2)      Type fallowing commands:
$site = Get-SPSite http://yoursitecollectionURL
$date = Get-Date “22/08/2012”
#(You need to check date format , type $date and press enter)
#Result like:  22 August 2012 00:00:00
#(and check the date is correct because it can be changed by regional settings. if date is in correct format )

You can fallow whats happening in background by tracing ULS logs in real time. And you can learn how many records are deleted.

//See you next article .


Date format is not correct in the DataFormWebPart SharePoint 2010

Ok there is some problem when formatting date’s which is different than US format when using XsltListViewWebPart has defined by Microsoft. This happens because the ddwrt:FormatDate function expects the data format to be in UTC and the XSLTListViewWebPart returns the date preformatted to the Web Locale or Locale Date/Time .

To fixing this issue Microsoft has released a new feature ,A new Property, EnableOriginalValue, has been added to the XlstListViewWebPart that unblocks this scenario by February CU 2012.

You can check fallowing article for more information:

For DataFormWebPart;the option is to use the DataFormWebPart with the following property set to false on the <SPDataSource> tag: UseServerDataFormat.
Make UseServerDataFormat property set to false the DataFormWebPart will receive the Date/Time in UTC format and then the ddwrt:FormatDate function will work accurately.

Or you can use power of xslt to format date as you wish:
Fallowing example will help you to how to do it.

Add fallowing codes in DataFormWebPart for suitable place for xsl:template

<xsl:template name=”FormatCorrectDate”>
<xsl:param name=”dateValue” />
<xsl:param name=”monthFormat” />

<!– Sperater is important here it should be “.” or “/” according your current language settings –>
<xsl:variable name=”day” select=”substring-before($dateValue, ‘.’)” />
<xsl:variable name=”month” select=”substring(substring-after($dateValue, ‘.’), 1, 2)” />
<xsl:variable name=”year” select=”substring(substring-after(substring-after($dateValue, ‘.’), ‘.’), 1, 4)” />

<!– Create US Date Format –>
<xsl:variable name=”USDate”>
<xsl:value-of select=”$month” />/<xsl:value-of select=”$day” />/<xsl:value-of select=”$year” />

<!– Month Notation –>
<xsl:variable name=”monthString”>
<xsl:when test=”$monthFormat=’M1′”>
<xsl:value-of select=”$month” />

<xsl:when test=”$monthFormat=’M2′”>
<xsl:value-of select=”ddwrt:FormatDateTime(string($USDate), 1055, ‘MMM’)” />
<xsl:value-of select=”ddwrt:FormatDateTime(string($USDate), 1055, ‘MMMM’)” />


<!– Create Date –>
test=”string-length($day) = 1″>0</xsl:when>

<xsl:value-of select=”$day” />-<xsl:value-of select=”$monthString” />-<xsl:value-of select=”$year” />

Call formatting template where you can needed in code :

<xsl:call-template name=”FormatCorrectDate”>
<xsl:with-param name=”dateValue” select=”string(@Created)” />
<xsl:with-param name=”monthFormat”>M2</xsl:with-param>