SharePoint Auditing Setting - Site Collection & Farm Setting

Question

I am confused with the auditing setting in SharePoint 2013.

1. The enable audit setting in Central admin has "days until purge". Suppose if I set this to 60 days what happens after 60 days?
2. If I set the above setting and don't enable auditing in site collection, I don't get audit reports. Correct?
3. With 60 days purge setting in CA, if I enable auditing in the site collection by enabling trimming & storing the audit log for 30 days. Does the audit reports are deleted after 30 days? Can I pull the data in custom report for more than 30 days or not?
4. How are these two settings connected if at all?

Greatly appreciate in clarifying my confusion. Thanks

Answer 1

The enable audit setting in Central admin has "days until purge". Suppose if I set this to 60 days what happens after 60 days?

All audits that are older than 60 days will not be shown in the Audit report.

If I set the above setting and don't enable auditing in the site collection, I don't get audit reports. Correct?

Yes, it's correct! The Audit is now enabled but you should Specify the events to audit on the site collection to get the Audit Report for these events!

With 60 days purge setting in CA, if I enable auditing in the site collection by enabling trimming & storing the audit log for 30 days. Does the audit reports are deleted after 30 days?

Yes, all audits that are older than 30 days will not be available.

If you enabled Audit Log Trimming in Audit settings of the Site collection, the value of specify the number of days of audit log data to retain will overwrite the default value in Central Admin.

Can I pull the data in custom report for more than 30 days or not?

No, because you have already enabled the Audit Log Trimming! but optionally you can archive the current audit log data in a document library before the data is trimmed. The schedule for audit log trimming is configured Monthly in Central Administration and you can change it at

• Monitoring > Review Job definitions > Audit Log Trimming.

How are these two settings connected if at all?

The value that set in the Secure store service properties for Enable Audit is the default value in case you have not enabled the Audit Log Trimming in the site collection.

Note: It's recommended to Automatically trim the audit log for site collections to avoid the performance issue on all the farm and to prevent the audit log from filling the hard drive. it's the main goal of Audit Log Trimming