Deleting sessions

Auditing allows you collect detailed information about activity in your organization. In some cases, however, you might have sessions that collect information that you are not interested in capturing or include information that you don’t want to store or make available to other auditors. For example, you might find there are sessions with very little activity or sessions that have been reviewed and are no longer needed. You might also notice that there are sessions that captured personally-identifying or medical data that other auditors should not be allowed to see. To handle these cases, you can selectively delete sessions from the audit store database.

In most cases, if you are the Master Auditor or have been granted permission to change the status of a session, you can mark sessions for deletion in Audit Analyzer. As noted in Reviewing and deleting your own sessions, however, you might be prevented from deleting your own sessions if the installation-level setting prevents users from deleting their own sessions.

To delete a specific session:

  1. Open Audit Analyzer console, then use a predefined or custom query to find the sessions that you want to delete.
  2. Select the sessions that you want to delete.
  3. Right-click, then select Delete.

    Audit Analyzer displays a confirmation message indicating that the deletion cannot be reversed.

  4. Click Yes to continue.

To delete all sessions in a query:

  1. Open Audit Analyzer, right-click a query node, then select Delete All Sessions.

    Audit Analyzer prompts you to confirm the deletion of all sessions returned by the query.

  2. Click Yes to continue.

    Audit Analyzer prompts you to confirm the deletion of sessions with a review status of To be Reviewed or Pending for Action.

  3. Click Yes to delete those sessions, or click No to continue the deletion of other sessions but preserve the sessions marked for retention.

    While the delete operations runs, you can click Stop Delete if needed. Sessions are partially deleted up until the point where the delete operation was cancelled.