Purging the Audit Log Table

Most Junoscope operations add multiple audit log records in the Audit Log table. As more and more operations are performed, this table grows in size and consumes disk space on the JUNOScope software server. The data in the Audit Log table is useful only to administrators. From time to time, you must remove records that are no longer used in the Audit Log table, and reclaim disk space if you are an administrator. You can purge all or selected audit log records, after filtering audit log records, using the filter options provided in the Purge GUI.

To purge the Audit Log table, follow these steps:

1. From the JUNOScope main window, click Monitor > Purge > Audit Log. The Audit Log Records Filter options dialog box appears.
2. In the Select Events Age area, specify the events you want to purge. You can choose to select all events, events within a specified date range, or events that are a specified number of months old.
3. Select from the following filter rules:
   • Limit to number of rows per page drop-down list box—Select how many record rows you want to display per audit log page: 10, 25, 50, or 100. The default is 10.
   • Sort results by column-name drop-down list box—Select the column of data by which the audit log records will be sorted in the table: Time, Username, Client address, Event type, or Message. The default is Time.
   • Event Category drop-down list box—Select the event category to display: Authentication, or Privileged Operations. Authentication activities include user login success, failure, logout, and session timeout. Privileged operations are changes of information in the system or in the network, such as restoring a configuration to a device or changing a user password. The default is Authentication.
   • Event Type drop-down list box—This list box is dynamically populated based on the event category that you selected. For example, if you select the Authentication event category, all authentication event message types appear in this drop-down list box.
   • Associated with user drop-down list box—Select records that are associated with a specified username.
4. Click Filter to proceed with the purge operation. The View Filtered Events dialog box appears. Click Reset to clear all the values you selected and return to the default values.

   The View Filtered Events dialog box displays the filter criteria and the list of the filtered audit log records with the date and time, username, client IP address. event type, and message. See Table 20 for a description of the information.The records are initially sorted by time in descending order, with the most recent events at the top of the list. Click on a column heading to sort the table information in ascending or descending sort order. Select the check boxes in the corresponding rows to select a filtered record. Select the check box in the column header row to select all filtered records in the dialog box.

5. Do one of the following:
   • Select the records you want to delete and click Delete Selected to purge the selected records.

     If you click Delete Selected, the Confirm Purge Audit Log Records dialog box appears listing the records you selected for deletion. Enter the reason for deleting audit log records in the Comment field.

     
   • Click Delete All Filtered Records if you want to delete all the filtered records.

     If you click Delete All Filtered Records, the Confirm Purge All Audit Log Records dialog box appears with the filter criteria and the number of records that will be deleted permanently. Enter the reason for deleting the audit log records in the Comment field.

     
6. Click OK in the Confirm Purge All Audit Log Records dialog box to confirm purge of audit log records. The audit log records are removed from the audit log table in the JUNOScope database. Click Cancel to go back to the View Filtered Events dialog box.

Copyright © 2008, Juniper Networks, Inc. All rights reserved. Trademark Notice.