Audit Log Trimming Timer Job stuck at "pausing" status

Hi,
We have a SharePoint 2010 farm and our Audit table is growing rapidly. I checked our "Audit log Trimming" timer job and it has been stuck at "pausing" status for more than a month. Any advice to resolve this issue would be great.
Thanks,
norasampang

Hi Trevor,
Do you think the reason that the time job is failing is because the audit log table is big and the audit timer jod times out. I saw your reply here at this
post 
where you have mentioned "
It may be timing out. Have you executed it manually to see if it runs without errors?
Can you please explain in more detail what you meant by that. I was thinking of trying to trim the Audit log using this script in small batch. Can you please let me know if this script seems right?
$site = Get-SPSite -Identity http://sharepointsite.com
$date = Get-Date
$date = $date.AddDays(-1021)
$site.Audit.DeleteEntries($date) 
At first i would like to delete all datas that are older than 1021 days old and eventually get rid of the other logs in smaller chunks. Any advice and suggestion would be highly appreciated.
Thanks,
norasampang

Similar Messages

  • User Profile Service - User Profile Incremental Synchronization Timer job stuck at 33% Status: Pausing

    User Profile Service - User Profile Incremental Synchronization Progress: 33% Status: Pausing
    It has been almost 15 days.
    Both User Profile Service and User Profile Synchronization Service are in Started state and FIM service also starting 
    I tried clearing sharePoint config cache.
    I also restarted the sharepoint timer service.
    I tried almost everything that is on Internet but nothing helped me.
    Is there any other way to solve the issue as I was struck on production server (ASAP) 
    In synchronization serivce manager status of MOSS_DeltaImport is Inprogress from past 2 days  
    Best Regards.

    Hi,
    Please follow the steps in the link below to clear the configuration cache.
    http://blogs.msdn.com/b/jamesway/archive/2011/05/23/sharepoint-2010-clearing-the-configuration-cache.aspx
    Here is a similar thread for your reference:
    https://social.technet.microsoft.com/Forums/en-US/beaa852c-6f40-428a-b97c-20722864e045/user-profile-service-user-profile-incremental-synchronization-timer-job-stuck-at-88-status?forum=sharepointadminprevious
    Or try to clear the file system cache on all servers in the server farm on which the Windows SharePoint Services Timer service is running. Microsoft has provided a step by step procedure on clearing file system cache from the SharePoint front-end servers
    in this kb article.
    You can also see the ULS logs and check error messages.
    http://sharepointlogviewer.codeplex.com/
    Best Regards
    Dennis Guo
    TechNet Community Support

  • Audit log trimmer timer job

    HI
    Audit log trimmer timer job
    what this job do 
    I set the sitecollection audit settings to trim the audit data after 7 days 
    is this job before delete it generate Excel report and save in document library?
    adil

    The job 'Trims audit trail entries from site collections.'
    It runs by defualt every month, which means you need to adjust the schedule so that it runs weekly so that it'll pick up your accelerated audit rules.
    This is the job that exports the data to Excel and cleans up the entries from the database.

  • Application Server Administration Service Timer Job stuck at Initialized 0% . Config Cache clear doesnt Help.MOSS2007

    Hi All,
    One of my WFE/Query server for MOSS is showing Application Server Administration Service Timer Job  stuck at Initialized  0% in CA timer Job status. 
    In timer Job Status in CA under the SSP Job Control service I find the Application Server Administration Service Timer Job  struck at 0%
    I have tried Clearing config cache of the Farm . I have tried disconnecting this server from Farm and reconnecting it with Psconfig UI, I have tried running Psconfig.exe on the affected server. But even after doing this service is stuck at 0%
    If I exit the OWSTimer.exe from task manager, it shows aborted at 0% . I am using a single SSP and reconfiguring SSP is not an option right now.
    Any help regarding it will be greatly appreciated.
    Regards,
    Rohit

    Hello,
    Have you changed the password recently? Also try to restart the windows timer service on all server.
    You might also want to check these threads:
    http://sharepoint.stackexchange.com/questions/44073/why-timer-job-stucks-at-initialized-status
    http://social.msdn.microsoft.com/Forums/en-US/d238cc1c-5c41-4762-9878-020cb36679c3/wss-30-workflow-timer-job-status-stuck-at-initialized-0
    http://social.technet.microsoft.com/Forums/sharepoint/en-US/7d932581-91a9-41f2-8848-95f8a72ba19b/timer-job-initialized-0?forum=sharepointadminlegacy
    Hemendra:Yesterday is just a memory,Tomorrow we may never see
    Please remember to mark the replies as answers if they help and unmark them if they provide no help

  • What is Audit Log Trimming job in Sharepoint ?

    What is Audit Log Trimming job  in Sharepoint

    Hi Sethu,
                        Did you understand What I am saying in the description
    WhenI run the 'Audit log trimming‘ timerjob
    manually for
    1st 2 times report has generated then onwards it is not
    generating any reports

  • UPS Jobs Stuck at Pausing

    Hi All,
    I am facing a problem with my Farm UPS. There are two UPS services running in the farm. my Farm consists of two App server and two WFEs and 2 Search Server and 1 OWA server. In App1 we have created two UPS services and in App2 we have created 1 UPS service.
    the Service created in APP2 is not in use but there is a timer job related to that Service running in the farm level.
    In App1 there are two UPS services running. one of them is functional and the other one is not functional. I want to know how to find which one of my UPS is running and which one is not functional. also I would like to know can I delete the non functional
    UPS from APP1 and APP2 server. will the deletion cause any problem to the farm?
    Also when I am checking the running times jobs of the farm I see the below timer job running in pausing mode for a long time (almost 10 days)
    User Profile Service Application - Activity Feed Cleanup Job
    UPS - Activity Feed Cleanup Job
    User Profile Service Application - Activity Feed Job
    UPS - Activity Feed Job
    User Profile Service Application - User Profile Language Synchronization Job
    UPS - Social Data Maintenance Job
    User Profile Service Application - Social Data Maintenance Job
    UPS - User Profile Language Synchronization Job
    UPS - User Profile Incremental Synchronization
    and the below timer job are running in "Running" State for more than 10 days.
    Crawl Log Cleanup for Search Application Search Service Application.
    Rebalance crawl store partitions for Search Service Application
    Can anybody please help me?

    cant any thing be done?

  • Informatio management policy timer job stuck at 2 percent

    Hi guys,
    I have set up a retention policy on a document library to move document to another location(a record library in a record center). However, I observed that the information management policy timer job never completes and just stays stuck at 2% for hours on
    end. I have restarted the timer service to no avail.
    I have check the ULS logs and nothing seems to point me to any errors.
    Please assist

    try restarting V4 timer service on app and web server
    Regards,
    Pratik Vyas | SharePoint Consultant |
    http://sharepointpratik.blogspot.com
    Posting is provided AS IS with no warranties, and confers no rights
    Please remember to click Mark As Answer if a post solves your problem or
    Vote As Helpful if it was useful.

  • ODSI 10Gr3 audit logs common/time question

    Hi
    With ODSI10GR3, We are investigating delays in processing of some DB2 Inserts
    Inserst occur daily but th eproblem happens maybe once in a week
    A review of the audit log during teh problem occurance shows the following
    Comon/time is taking 33 seconds
    common/time {
    timestamp: Mon Mar 01 10:21:36 PST 2010
    duration: 33323 }
    with compile time being ~ 14 sec and insert time being ~ 4 seconds
    Is it possible that things such as full gc ooccuring can impact this time?
    We increased tx timeout to 120 seconds to avoid the timeout but would like to investigate further on this.
    Thanks Much for any info
    Best
    ####<Mar 1, 2010 10:22:09 AM PST> <Info> <ODSI> <qa-sc-eibapp02.corp.test.com> <ds_ms2> <[ACTIVE] ExecuteThread: '1' for queue: 'weblogic.kernel.Default (self-tuning)'> <service.uateibsads> <> <> <1267467729490> <BEA-000000> <ClientDataspace> <DSPAuditEvent timestamp: Mon Mar 01 10:21:36 PST 2010 severity: FAILURE id: ClientDataspace:48:Mon Mar 01 10:21:36 PST 2010 {
    common/application {
    user: service.uateibsads
    name: ClientDataspace
    eventkind: update
    server: ds_ms2
    query/performance {
    compiletime: 14869
    update/relational {
    source: CBS_DB2_DS
    sql: INSERT INTO "S109935E"."C@CR538"."C@CUNEW01" ("C@STATUS", "C@SEQNBR", "CUBK", "CUNBR", "CUSTAT",
    "CUALT", "CUNA1", "CUNA2", "CUNA3", "CUNA4", "CUNA5", "CUNA6", "CUZIP", "CUZIP2", "CUZIP3",
    "CUZIP4", "CUSHRT", "CUSSNR@", "CUSSTY", "CUCLPH", "CUHMPH", "CUBUPH", "CUPOFF", "CUSOFF",
    "CUPOF1", "CUPOF2", "CUOPDT", "CUTYPE", "CUTYP", "CUSIC", "CUSEX", "CURACE", "CUOWN", "CUYREM",
    "CUINC", "CUSRIN", "CUBDTE", "CUDEP", "CUCTC", "CUCTCT", "CUCIRA", "CUMNBR", "CUNTID", "CUUSR1",
    "CUCLNK", "CUUSR3", "CUCDCH", "CUCDCN", "CUCDCD", "CUCMCH", "CUCMNR", "CUCMCD", "CUCVSH",
    "CUCVCN", "CUCVCD", "CUCATH", "CUCATN", "CUCATD", "CUCLNG", "CUCCCD", "CULGLR", "CUCWHP",
    "CUCPSP", "CUCTXN", "CUCPRF", "CUSHKY", "CUITLD", "CUPSTL", "CUACOM", "CUBRCH", "CUMIDT@",
    "CUMRTS", "CUMAIL", "CUSOLI", "CUSOCI", "CUCPNA", "CUBPNA", "CUPERS", "CUSALU", "CUFAX",
    "CUTELX", "CUTXAN", "CUDOCF", "CUDCDT", "CUTINU", "CUTADT@", "CUWPRT", "CUCECD", "CUCELM",
    "CUEXTF", "CUMTND", "CUCNCD", "CUMARK", "CUEMPL", "CUINQ", "CUMNT", "CUCENS", "CUCODT", "CUDEDT",
    "CUACCD", "CUBYR1", "CUBYR2", "CUPREF", "CUJBDT", "CUJDDT", "CUEMA1", "CUEMA2", "CUOPT",
    "CUOPTD", "CUSPFG", "CUOENTTYP", "CUCENTTYP", "CUAMDT", "CUESDT", "CUENA1", "CUENA2", "CUENA3",
    "CUENA4", "CUENA5", "CUENA6", "CUEPST", "CUEZIP", "CUEZIS", "CUEZP3", "CUEZP4", "CUAAPL",
    "CUAAKY", "CUAREC", "CUASTA", "CUANA1", "CUANA2", "CUANA3", "CUANA4", "CUANA5", "CUANA6",
    "CUAZP1", "CUAZP2", "CUAZP3", "CUAZP4", "CUAPSD", "CUASTR", "CUASTP", "CUASTS", "CUAFLG",
    "CUARFG", "CUCLS", "CURISK", "CURDT1", "CURSK2", "CURDT2", "CUCRLN", "CUCRDT", "CUCRFR",
    "CUCRND", "CUCRPR", "CUFSDT", "CUFSFR", "CUFSND", "CUSALE", "CUCSTS", "CUNETI", "CUPRJI",
    "CUASST", "CUCURA", "CUCASH", "CUACCR", "CUMKTS", "CUREAL", "CULIFE", "CUINVN", "CUFIXA",
    "CULIAB", "CUCURL", "CULTRM", "CUNETW", "CUDIRL", "CUINDL", "CUDIRT", "CUINDT", "CUREDB",
    "CULCRO", "CUOTHA", "CUOTHL", "CU5WHP", "CUIWHY", "CUWHEX", "CUFILL", "CUREC1", "CUSTAD",
    "CUFRN1", "CUCHIB", "CUCHID", "CUCLOB", "CUCLOD", "CUCCDD", "CUCDD1", "CUCDD2", "CUCHD1",
    "CUCHD2", "CUCHP1", "CUCHP2", "CUCHP3", "CUCHP4", "CUCOL1", "CUCOL2", "CUCOL3", "CUCOL4",
    "CUCCDT", "CUCCYD", "CUCTYD", "CUCIDB", "CUCDIR", "CUCIND", "CUCSEC", "CUCUNS", "CUCILD",
    "CUCOPN", "CUCTOD", "CUCNON", "CUCHGO", "CUCRNB", "CUCQAG", "CUCQHU", "CUCQHI", "CUCQLO",
    "CUCQDD", "CUCQDT", "CUDPD1", "CUDPD2", "CUDPD3", "CUDPDP", "CUDPD", "CUIPD", "CUUPD", "CUCAGY",
    "CUCIAM", "CUCIAY", "CUCPAM", "CUCPAY", "CUCLTC", "CUCLSO", "CUUCMO", "CULCCA", "CUDRSD",
    "CUFACS", "CUINDS", "CUIPDS", "CUSECS", "CUUNSS", "CUDPDS", "CUUCMS", "CUBDIR", "CUBCMO",
    "CUTHR1", "CUTHR2", "CUTHR3", "CUTHR4", "CUTHR5", "CUFIV1", "CUFIV2", "CUFIV3", "CUFIV4",
    "CUFIV5", "CUTEN1", "CUTEN2", "CUTEN3", "CUTEN4", "CUTEN5", "CUTWN1", "CUTWN2", "CUTWN3",
    "CUTWN4", "CUTWN5", "CUTHI1", "CUTHI2", "CUTHI3", "CUTHI4", "CUTHI5", "CUSEV1@", "CUSEV2",
    "CUSEV3", "CUSEV4", "CUSEV5")
    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?,
    rowsmodified: 1
    time: 3655
    common/application {
    exception: Transaction timed out after 29 seconds
    BEA1-000021E917F59C34B15A
    update/service {
    procedure: InsertNewCIF
    arity: 1
    dataservice: ld:CoreBankingSystem/LogicalServices/CreateNewCIF.ds
    script: declare namespace ns0="ld:CoreBankingSystem/LogicalServices/CreateNewCIF";
    declare namespace ns1="http://www.test.com/schemas/client/cbs/logical";
    declare variable $__fparam0 as element(ns1:NewCIF)* external;
    { return value ns0:InsertNewCIF($__fparam0); }
    common/time {
    timestamp: Mon Mar 01 10:21:36 PST 2010
    duration: 33323 }

    1) Is it possible that there is a database lock preventing the insert from being committed?
    2) What does the audit look like for a successful update?
    3) Notice that the "compile time" is non-zero. This indicates that the plan was not cached. Likely because it is the first time this was executed after the server was started. So not only do you have the extra query compilation time, there would also be time for loading classes and other initialization. (but 12 seconds of loading an initialization seems like a lot). Given that increasing the tx time to 120 seconds solves the problem (it does solve the problem, doesn't it?) I would say that this is the issue.
    4) Given that you just started the server (right? see (3)), it's not likely this is due to GC. But you could enable gc verbose to see.

  • TS3147 Printers Pausing: Other Users Log-off before job done permanently pauses printers

    I have a problem with printers pausing. I work for a University, and this concerns computer lab Macs. Whenever someone Prints to a printer, and logs off before the print job is completely though, the printer pauses permanently for all other users.
    I have found 2 temporary fixes:
         1) have initial user log back in, and allow job to complete (Hard to do, since there are 4000+ students here)
         2) Delete printer and re-add them (I unpause close to 1-3 printers a day this way currently)
    Since those fixes require multiple trips, and or trying to reach people, they are not great solutions
    How can I fix this problem so it won't happen again?
    Theories of how to fix I don't know how to impliment (I normally am a PC guy):
         1) Clear print que on log-off Script
         2) Delay Log-off Script (Allow print job to go though)
         3) Checkbox somewhere to override the printers pausing?
    Happens on both our iMacs, and Mac Minis we use on campus.

    4on6 wrote:There are some related threads in this forum, but I still can't figure out what is my problem (printer works in some situations - printing a pdf in evince or a webpage in chromium - but in others not, e.g. printing from emacs).
    The distinction that comes to mind here is that emacs (and some others) will print via lp.  I suspect that the default printer for lp is not set, and therefore the print job is lost.
    To test this, create ~/.cups/lpoptions (if you don't already have it) with the content:
    Default <The_Name_Of_My_Printer_In_CUPS>
    And see if that helps.

  • Can BPMon monitor jobs stuck in 'Released' mode?

    Hi SAP Experts,
    I would like to monitor certain jobs stuck with the status of 'Released' as seen in SM37. Can BPMon do that kind of monitoring? Please advise, thanks.
    Regards,
    Kim Yong

    Hello,
    the Start Delay in BPMon should wok anyway it just depends on the start procedure you use.
    In your case without a pre-defined start time you should chose start procedure "use job start condition" then every job is picked up if the name fits the critieria. On with this start procedure the start delay corresponds to the information in SM37.
    If you use the start procedure "by time" instead then you have to enter a planned start time and then BPMon measures the deviation from this start time, so here we are talking about a real start delay from a business perspective. In the former case we "only" talk about a technical delay that you see in SM37.
    For the purpose described below you should go with the first option I described.
    Best Regards
    Volker

  • When will audit on "CREATE SESSION" generate audit log?

    Hi,
    When we setup audit on "CREATE SESSION" for all uses with access, does it mean there will be an audit log every time some user is granted "CREATE SESSION" or does it mean that there will be an audit log every time a user connects? ( I'm assuming internally "CREATE SESSION" is executed every time user logs into the database)
    The command would be something like: audit CREATE SESSION by access
    Thanks for the help.

    Hozy wrote:
    Thanks Aman.
    I read somewhere that it is a good practice to enable audit on "CREATE SESSION" for all the users by access, and the next question that came to my mind is if we do this, when will the audit log get generated?To enabling auditing you have to set audit_trail initialization parameter,please refer
    http://www.oracle-base.com/articles/10g/Auditing_10gR2.php
    If it is everytime a user connects, then it will be a performance overhead.No,but after some days you can delete old records from sys.aud$

  • How to schedule a batch job to generate security audit log (SM20)

    May be this is a repeat question for this forum. Apologize, if it is. Is there a way to schedule a batch job to generate security audit log (SM20) automatically and possibly send a message to SAP Inbox or generate a spool request? Release is 4.6C.
    Regards
    Nirmal

    > May be this is a repeat question for this forum. Apologize, if it is.
    You don't need to apologize. You only need to do a very simple search...
    > Total Questions:  18 (16 unresolved) 
    Perhaps 16 of those 18 questions you have not followed up on could have been spared as well?
    Please do the needfull.
    Cheers,
    Julius

  • "logon time" between USR41 and security audit log

    Dear colleagues,
    I got a following question from customer for security audit reason.
    > 'Logon date' and 'Logon time' values stored in table  USR41 are exactly same as
    > logon history of Security Audit Log(Tr-cd:SM20)?
    Table:USR41 saves 'logon date' and 'logon time' when user logs on to SAP System from SAP GUI.
    And the Security Audit Log(Tr-cd:SM20) can save user's logon history;
    at the time when user logged on, the security audit log is recorded .
    I tried to check SAP GUI logon program:SAPMSYST several ways, however,
    I could not check it because the program is protected even for read access.
    I want to know about specification of "logon time" between USR41 and security audit log,
    or about how to look into the program:SAPMSYST and debug it.
    Thank you.
    Best Regards.

    Hi,
    If you configure Security Audit you can achieve your goals...
    1-Audit the employees how access the screens, tables, data...etc
    Answer : Option 1 & 3
    2-Audit all changes by all users to the data
    Answer : Option 1 & 3
    3-Keep the data up to one month
    Answer: No such settings, but you can define maximum log size.
    4-Log retention period can be defined.
    Answer: No !.. but you can define maximum log size.
    SM19/SM20 Options:
    1-Dialog logon
    You can check how many users logged in and at what time
    2-RFC login/call
    Same as above you can check RFC logins
    3-Transaction/report start
    You can see which report or transaction are executed and at what time
    (It will help you to analyise unauthorized data change. Transactions/report can give you an idea, what data has been changed. So you can see who changed the data)
    4-User master change
    (You can see user master changes log with this option)
    5-System/Other events
    (System error can be logged using this option)
    Hope, it clear the things...
    Regards.
    Rajesh Narkhede

  • Job log, audit log

    Hi.
    Are there any log files to delete manually periodic?
    I know the log files are deleted by standard delete job scheduled in Tr-cd SM36.
    How about the JOB log, and audit log?
    regards,

    Apart from SM36 standard logs,
    you might want to re-orgnaize log/trace files in various directories:
    /local/data/interface - generally the interface directory
    /usr/sap/<SID>/../work - Work process trace files etc.
    Regards,
    Siddhesh

  • How change sStart and End Date and time in the Audit log ???

    Install C2S BM39SP1. Work.
    Go to the: https://bmserver:8009
    Open : VPN Monitor | Audit log information.
    Problem - can not cahnge Date and time in the Audit Log Start(End)
    How i vcan do this ?
    How i can get every day stat log:
    login ; date_time_login ; dtae_timie_logout ; bite_in ; bite_out
    Serg

    Serg,
    It appears that in the past few days you have not received a response to your
    posting. That concerns us, and has triggered this automated reply.
    Has your problem been resolved? If not, you might try one of the following options:
    - Visit http://support.novell.com and search the knowledgebase and/or check all
    the other self support options and support programs available.
    - You could also try posting your message again. Make sure it is posted in the
    correct newsgroup. (http://support.novell.com/forums)
    Be sure to read the forum FAQ about what to expect in the way of responses:
    http://support.novell.com/forums/faq_general.html
    If this is a reply to a duplicate posting, please ignore and accept our apologies
    and rest assured we will issue a stern reprimand to our posting bot.
    Good luck!
    Your Novell Product Support Forums Team
    http://support.novell.com/forums/

Maybe you are looking for