@@ -125,6 +125,56 @@ log entry:
1251252023-06-13 03:43:29.233 [info] coderd: audit_log ID=95f7c392-da3e-480c-a579-8909f145fbe2 Time="2023-06-13T03:43:29.230422Z" UserID=6c405053-27e3-484a-9ad7-bcb64e7bfde6 OrganizationID=00000000-0000-0000-0000-000000000000 Ip=<nil> UserAgent=<nil> ResourceType=workspace_build ResourceID=988ae133-5b73-41e3-a55e-e1e9d3ef0b66 ResourceTarget="" Action=start Diff="{}" StatusCode=200 AdditionalFields="{\"workspace_name\":\"linux-container\",\"build_number\":\"7\",\"build_reason\":\"initiator\",\"workspace_owner\":\"\"}" RequestID=9682b1b5-7b9f-4bf2-9a39-9463f8e41cd6 ResourceIcon=""
126126```
127127
128+ ##Purging Old Audit Logs
129+
130+ > [ !WARNING]
131+ > Audit Logs provide critical security and compliance information. Purging Audit Logs may impact your organization's ability
132+ > to investigate security incidents or meet compliance requirements. Consult your security and compliance teams before purging any audit data.
133+
134+ Audit Logs are not automatically purged from the database, though they can account for a large amount of disk usage.
135+ Use the following query to determine the amount of disk space used by the` audit_logs ` table.
136+
137+ ``` sql
138+ SELECT
139+ relnameAS table_name,
140+ pg_size_pretty(pg_total_relation_size(relid))AS total_size,
141+ pg_size_pretty(pg_relation_size(relid))AS table_size,
142+ pg_size_pretty(pg_indexes_size(relid))AS indexes_size,
143+ (SELECT COUNT (* )FROM audit_logs)AS total_records
144+ FROM pg_catalog .pg_statio_user_tables
145+ WHERE relname= ' audit_logs'
146+ ORDER BY pg_total_relation_size(relid)DESC ;
147+ ```
148+
149+ Should you wish to purge these records, it is safe to do so. This can only be done by running SQL queries
150+ directly against the` audit_logs ` table in the database. We advise users to only purge old records (>1yr)
151+ and in accordance with your compliance requirements.
152+
153+ ###Backup/Archive
154+
155+ Consider exporting or archiving these records before deletion:
156+
157+ ``` sql
158+ -- Export to CSV
159+ COPY (SELECT * FROM audit_logsWHERE time < CURRENT_TIMESTAMP - INTERVAL' 1 year'
160+ TO' /path/to/audit_logs_archive.csv' ' ,'
161+
162+ -- Copy to archive table
163+ CREATE TABLE audit_logs_archive AS
164+ SELECT * FROM audit_logsWHERE time < CURRENT_TIMESTAMP - INTERVAL' 1 year'
165+ ```
166+
167+ ###Permanent Deletion
168+
169+ > [ !NOTE]
170+ > For large` audit_logs ` tables, consider running the` DELETE ` operation during maintenance windows as it may impact
171+ > database performance. You can also batch the deletions to reduce lock time.
172+
173+ ``` sql
174+ DELETE FROM audit_logsWHERE time < CURRENT_TIMESTAMP - INTERVAL' 1 year'
175+ -- Consider running `VACUUM VERBOSE audit_logs` afterwards for large datasets to reclaim disk space.
176+ ```
177+
128178##How to Enable Audit Logs
129179
130- This feature is only available with a[ Premium license] ( ../licensing/index.md ) .
180+ This feature is only available with a[ Premium license] ( ../licensing/index.md ) , and is automatically enabled .