SharePoint 2013 Audit usage files deleted every night

Question

We have a SP2013 version and in all the site collections they have enabled the auditing. Some business users pull the audit report every month to see the traffic to their sites using "Run custom reports" link under Audit Reports. From last couple of months, the reports are just pulling the information from previous day not entire month. Usage logs are cleared every night for the previous day without considering the settings in either CA or site collections. So in custom report if I run a report for last week, I get an error saying "Report contain no data". I get data only if I include todays date.

This happens in all the site collections in the farm.

Troubleshooting I have done so far.

• Making sure auditing is enabled in CA & Site collection level. Audit purge/trimming is set to 30 days at both places.
• No issues with the timer jobs for Usage service application.
• No issues with the search/search history.
• Logs are pulled into database successfully every 5 min.
• Logs doesn’t have much information about auditing.
• Powershell commands $site.Audit.getentries() also shows just previous day data.

Any pointers for troubleshooting is greatly appreciated.

Answer 1

Check if there is any third-party application runs a delete query against the AuditData database to delete audit logs.

Try to use SQL Profiler to determine whether a delete query actually deletes the audit data from the AuditData database.

More information refer to the article:

Audit logging is deleted even though audit data retention is enabled in SharePoint