Thank you!
I have built a list of database table names based off the existing _Archive tables and the Log categories listed in the settings UI:
Logs
Backup Logs
BackupLog
BackupLog_Archive
Connection logs
ConnectionLog
ConnectionLog_Archive
Login attempt
LoginAttempt
LoginAttempt_Archive
Login history
LoginHistory
LoginHistory_Archive
Message Logs (Log messages?)
LogMessage
LogMessage_Archive
LogMessage_Old
LogMessage_Old_Archive
PAM logs
PamLog
PamLog_Archive
User info history
UserInfoHistory
UserInfoHistory_Archive
PAM
Checkout
PamCheckout
PamCheckout_Archive
Heartbeat
PamHeartbeat
PamHeartbeat_Archive
Connections
Connection history
ConnectionHistory
ConnectionHistory_Archive
Privileged sessions monitoring
Remote sessions
RemoteSession
RemoteSession_Archive
Traffic events
TrafficEvent
TrafficEvent_Archive
But with some tables (most importantly ConnectionHistory) I'm not sure which field to use to compare the "DeleteBefore" timestamps
Currently I'm looking at the following fields, but I'm not sure they are the correct ones:
BackupLog.StartDate, BackupLog_Archive.StartDate, ConnectionLog.CreationDate, ConnectionLog_Archive.CreationDate, LoginAttempt.CreationDate, LoginAttempt_Archive.CreationDate, LoginHistory.CreationDate, LoginHistory_Archive.CreationDate, LogMessage.CreationDate, LogMessage_Archive.CreationDate, LogMessage_Old.CreationDate, LogMessage_Old_Archive.CreationDate, PamLog.DateTime, PamLog_Archive.DateTime, UserInfoHistory.ModifiedDate, UserInfoHistory_Archive.ModifiedDate, PamCheckout.CheckoutDateTime, PamCheckout_Archive.CheckoutDateTime, PamHeartbeat.HeartbeatDateTime, PamHeartbeat_Archive.HeartbeatDateTime, ConnectionHistory.ModifiedDate, ConnectionHistory_Archive.ModifiedDate, RemoteSession.StartDateTime, RemoteSession_Archive.StartDateTime, TrafficEvent.ConnectedAt, TrafficEvent_Archive.ConnectedAt
These tables have multiple datetime fields for example:
BackupLog.StartDate, BackupLog.EndDate
ConnectionHistory.ModifiedDate, ConnectionHistory.CreationDate,
TrafficEvent.ConnectedAt, TrafficEvent.DisconnectedAt, TrafficEvent.CreatedAt
By the way, I think "Message Logs" should be changed to "Log messages" in the UI
Here's an overview of our log table usage currently:
[image]
Best regards,
Daniel