Dec 1, 2025 · Dec 1, 2025 · Dec 1, 2025
diff --git a/coderd/database/dbauthz/dbauthz.go b/coderd/database/dbauthz/dbauthz.go
 return q.db.DeleteOldAuditLogConnectionEvents(ctx, threshold)
 }

 func (q *querier) DeleteOldAuditLogs(ctx context.Context, arg database.DeleteOldAuditLogsParams) (int64, error) {
 if err := q.authorizeContext(ctx, policy.ActionDelete, rbac.ResourceSystem); err != nil {
 return 0, err
 }
 return q.db.DeleteOldAuditLogs(ctx, arg)
 }

 func (q *querier) DeleteOldConnectionLogs(ctx context.Context, arg database.DeleteOldConnectionLogsParams) (int64, error) {
 if err := q.authorizeContext(ctx, policy.ActionDelete, rbac.ResourceSystem); err != nil {
 return 0, err
diff --git a/coderd/database/dbauthz/dbauthz_test.go b/coderd/database/dbauthz/dbauthz_test.go
 dbm.EXPECT().DeleteOldAuditLogConnectionEvents(gomock.Any(), database.DeleteOldAuditLogConnectionEventsParams{}).Return(nil).AnyTimes()
 check.Args(database.DeleteOldAuditLogConnectionEventsParams{}).Asserts(rbac.ResourceSystem, policy.ActionDelete)
 }))
 s.Run("DeleteOldAuditLogs", s.Mocked(func(dbm *dbmock.MockStore, _ *gofakeit.Faker, check *expects) {
 dbm.EXPECT().DeleteOldAuditLogs(gomock.Any(), database.DeleteOldAuditLogsParams{}).Return(int64(0), nil).AnyTimes()
 check.Args(database.DeleteOldAuditLogsParams{}).Asserts(rbac.ResourceSystem, policy.ActionDelete)
 }))
 }

 func (s *MethodTestSuite) TestConnectionLogs() {
diff --git a/coderd/database/dbmetrics/querymetrics.go b/coderd/database/dbmetrics/querymetrics.go
diff --git a/coderd/database/dbmock/dbmock.go b/coderd/database/dbmock/dbmock.go
diff --git a/coderd/database/dbpurge/dbpurge.go b/coderd/database/dbpurge/dbpurge.go
 // Batch size for connection log deletion. Smaller batches prevent long-held
 // locks that could impact concurrent database operations.
 connectionLogsBatchSize = 1000
 // Batch size for audit log deletion.
 auditLogsBatchSize = 1000
 // Telemetry heartbeats are used to deduplicate events across replicas. We
 // don't need to persist heartbeat rows for longer than 24 hours, as they
 // are only used for deduplication across replicas. The time needs to be
 }
 }

 var purgedAuditLogs int64
 auditLogsRetention := vals.Retention.AuditLogs.Value()
 if auditLogsRetention == 0 {
 auditLogsRetention = vals.Retention.Global.Value()
 }
 if auditLogsRetention > 0 {
 deleteAuditLogsBefore := start.Add(-auditLogsRetention)
 purgedAuditLogs, err = tx.DeleteOldAuditLogs(ctx, database.DeleteOldAuditLogsParams{
 BeforeTime: deleteAuditLogsBefore,
 LimitCount: auditLogsBatchSize,
 })
 if err != nil {
 return xerrors.Errorf("failed to delete old audit logs: %w", err)
 }
 }

 logger.Debug(ctx, "purged old database entries",
 slog.F("expired_api_keys", expiredAPIKeys),
 slog.F("aibridge_records", purgedAIBridgeRecords),
 slog.F("connection_logs", purgedConnectionLogs),
 slog.F("audit_logs", purgedAuditLogs),
 slog.F("duration", clk.Since(start)),
 )

diff --git a/coderd/database/dbpurge/dbpurge_test.go b/coderd/database/dbpurge/dbpurge_test.go
 require.NoError(t, err)
 require.Len(t, newToolUsages, 1, "near threshold tool usages should not be deleted")
 }

 func TestDeleteOldAuditLogs(t *testing.T) {
 t.Parallel()

 now := time.Date(2025, 1, 15, 7, 30, 0, 0, time.UTC)
 retentionPeriod := 30 * 24 * time.Hour
 afterThreshold := now.Add(-retentionPeriod).Add(-24 * time.Hour) // 31 days ago (older than threshold)
 beforeThreshold := now.Add(-15 * 24 * time.Hour)                 // 15 days ago (newer than threshold)

 testCases := []struct {
 name                  string
 retentionConfig       codersdk.RetentionConfig
 oldLogTime            time.Time
 recentLogTime         *time.Time // nil means no recent log created
 expectOldDeleted      bool
 expectedLogsRemaining int
 }{
 {
 name: "RetentionEnabled",
 retentionConfig: codersdk.RetentionConfig{
 AuditLogs: serpent.Duration(retentionPeriod),
 },
 oldLogTime:            afterThreshold,
 recentLogTime:         &beforeThreshold,
 expectOldDeleted:      true,
 expectedLogsRemaining: 1, // only recent log remains
 },
 {
 name: "RetentionDisabled",
 retentionConfig: codersdk.RetentionConfig{
 AuditLogs: serpent.Duration(0),
 },
 oldLogTime:            now.Add(-365 * 24 * time.Hour), // 1 year ago
 recentLogTime:         nil,
 expectOldDeleted:      false,
 expectedLogsRemaining: 1, // old log is kept
 },
 {
 name: "GlobalRetentionFallback",
 retentionConfig: codersdk.RetentionConfig{
 Global:    serpent.Duration(retentionPeriod),
 AuditLogs: serpent.Duration(0), // Not set, should fall back to global
 },
 oldLogTime:            afterThreshold,
 recentLogTime:         &beforeThreshold,
 expectOldDeleted:      true,
 expectedLogsRemaining: 1, // only recent log remains
 },
 }

 for _, tc := range testCases {
 t.Run(tc.name, func(t *testing.T) {
 t.Parallel()

 ctx := testutil.Context(t, testutil.WaitShort)
 clk := quartz.NewMock(t)
 clk.Set(now).MustWait(ctx)

 db, _ := dbtestutil.NewDB(t, dbtestutil.WithDumpOnFailure())
 logger := slogtest.Make(t, &slogtest.Options{IgnoreErrors: true})

 // Setup test fixtures.
 user := dbgen.User(t, db, database.User{})
 org := dbgen.Organization(t, db, database.Organization{})

 // Create old audit log.
 oldLog := dbgen.AuditLog(t, db, database.AuditLog{
 UserID:         user.ID,
 OrganizationID: org.ID,
 Time:           tc.oldLogTime,
 Action:         database.AuditActionCreate,
 ResourceType:   database.ResourceTypeWorkspace,
 })

 // Create recent audit log if specified.
 var recentLog database.AuditLog
 if tc.recentLogTime != nil {
 recentLog = dbgen.AuditLog(t, db, database.AuditLog{
 UserID:         user.ID,
 OrganizationID: org.ID,
 Time:           *tc.recentLogTime,
 Action:         database.AuditActionCreate,
 ResourceType:   database.ResourceTypeWorkspace,
 })
 }

 // Run the purge.
 done := awaitDoTick(ctx, t, clk)
 closer := dbpurge.New(ctx, logger, db, &codersdk.DeploymentValues{
 Retention: tc.retentionConfig,
 }, clk)
 defer closer.Close()
 testutil.TryReceive(ctx, t, done)

 // Verify results.
 logs, err := db.GetAuditLogsOffset(ctx, database.GetAuditLogsOffsetParams{
 LimitOpt: 100,
 })
 require.NoError(t, err)
 require.Len(t, logs, tc.expectedLogsRemaining, "unexpected number of logs remaining")

 logIDs := make([]uuid.UUID, len(logs))
 for i, log := range logs {
 logIDs[i] = log.AuditLog.ID
 }

 if tc.expectOldDeleted {
 require.NotContains(t, logIDs, oldLog.ID, "old audit log should be deleted")
 } else {
 require.Contains(t, logIDs, oldLog.ID, "old audit log should NOT be deleted")
 }

 if tc.recentLogTime != nil {
 require.Contains(t, logIDs, recentLog.ID, "recent audit log should be kept")
 }
 })
 }

 // ConnectionEventsNotDeleted is a special case that tests multiple audit
 // action types, so it's kept as a separate subtest.
 t.Run("ConnectionEventsNotDeleted", func(t *testing.T) {
 t.Parallel()

 ctx := testutil.Context(t, testutil.WaitShort)
 clk := quartz.NewMock(t)
 clk.Set(now).MustWait(ctx)

 db, _ := dbtestutil.NewDB(t, dbtestutil.WithDumpOnFailure())
 logger := slogtest.Make(t, &slogtest.Options{IgnoreErrors: true})
 user := dbgen.User(t, db, database.User{})
 org := dbgen.Organization(t, db, database.Organization{})

 // Create old connection events (should NOT be deleted by audit logs retention).
 oldConnectLog := dbgen.AuditLog(t, db, database.AuditLog{
 UserID:         user.ID,
 OrganizationID: org.ID,
 Time:           afterThreshold,
 Action:         database.AuditActionConnect,
 ResourceType:   database.ResourceTypeWorkspace,
 })

 oldDisconnectLog := dbgen.AuditLog(t, db, database.AuditLog{
 UserID:         user.ID,
 OrganizationID: org.ID,
 Time:           afterThreshold,
 Action:         database.AuditActionDisconnect,
 ResourceType:   database.ResourceTypeWorkspace,
 })

 oldOpenLog := dbgen.AuditLog(t, db, database.AuditLog{
 UserID:         user.ID,
 OrganizationID: org.ID,
 Time:           afterThreshold,
 Action:         database.AuditActionOpen,
 ResourceType:   database.ResourceTypeWorkspace,
 })

 oldCloseLog := dbgen.AuditLog(t, db, database.AuditLog{
 UserID:         user.ID,
 OrganizationID: org.ID,
 Time:           afterThreshold,
 Action:         database.AuditActionClose,
 ResourceType:   database.ResourceTypeWorkspace,
 })

 // Create old non-connection audit log (should be deleted).
 oldCreateLog := dbgen.AuditLog(t, db, database.AuditLog{
 UserID:         user.ID,
 OrganizationID: org.ID,
 Time:           afterThreshold,
 Action:         database.AuditActionCreate,
 ResourceType:   database.ResourceTypeWorkspace,
 })

 // Run the purge with audit logs retention enabled.
 done := awaitDoTick(ctx, t, clk)
 closer := dbpurge.New(ctx, logger, db, &codersdk.DeploymentValues{
 Retention: codersdk.RetentionConfig{
 AuditLogs: serpent.Duration(retentionPeriod),
 },
 }, clk)
 defer closer.Close()
 testutil.TryReceive(ctx, t, done)

 // Verify results.
 logs, err := db.GetAuditLogsOffset(ctx, database.GetAuditLogsOffsetParams{
 LimitOpt: 100,
 })
 require.NoError(t, err)
 require.Len(t, logs, 4, "should have 4 connection event logs remaining")

 logIDs := make([]uuid.UUID, len(logs))
 for i, log := range logs {
 logIDs[i] = log.AuditLog.ID
 }

 // Connection events should NOT be deleted by audit logs retention.
 require.Contains(t, logIDs, oldConnectLog.ID, "old connect log should NOT be deleted by audit logs retention")
 require.Contains(t, logIDs, oldDisconnectLog.ID, "old disconnect log should NOT be deleted by audit logs retention")
 require.Contains(t, logIDs, oldOpenLog.ID, "old open log should NOT be deleted by audit logs retention")
 require.Contains(t, logIDs, oldCloseLog.ID, "old close log should NOT be deleted by audit logs retention")

 // Non-connection event should be deleted.
 require.NotContains(t, logIDs, oldCreateLog.ID, "old create log should be deleted by audit logs retention")
 })
 }
diff --git a/coderd/database/querier.go b/coderd/database/querier.go
diff --git a/coderd/database/queries.sql.go b/coderd/database/queries.sql.go
diff --git a/coderd/database/queries/auditlogs.sql b/coderd/database/queries/auditlogs.sql
    ORDER BY "time" ASC
    LIMIT @limit_count
 );

 -- name: DeleteOldAuditLogs :one
 -- Deletes old audit logs based on retention policy, excluding deprecated
 -- connection events (connect, disconnect, open, close) which are handled
 -- separately by DeleteOldAuditLogConnectionEvents.
 WITH old_logs AS (
    SELECT id
    FROM audit_logs
    WHERE
        "time" < @before_time::timestamp with time zone
        AND action NOT IN ('connect', 'disconnect', 'open', 'close')
    ORDER BY "time" ASC
    LIMIT @limit_count
 ),
 deleted_rows AS (
    DELETE FROM audit_logs
    USING old_logs
    WHERE audit_logs.id = old_logs.id
    RETURNING audit_logs.id
 )
 SELECT COUNT(deleted_rows.id) AS deleted_count FROM deleted_rows;
Original file line number	Diff line number	Diff line change
Expand Up		@@ -1749,6 +1749,13 @@ func (q *querier) DeleteOldAuditLogConnectionEvents(ctx context.Context, thresho
		return q.db.DeleteOldAuditLogConnectionEvents(ctx, threshold)
		}

		func (q *querier) DeleteOldAuditLogs(ctx context.Context, arg database.DeleteOldAuditLogsParams) (int64, error) {
		if err := q.authorizeContext(ctx, policy.ActionDelete, rbac.ResourceSystem); err != nil {
		return 0, err
		}
		return q.db.DeleteOldAuditLogs(ctx, arg)
		}

		func (q *querier) DeleteOldConnectionLogs(ctx context.Context, arg database.DeleteOldConnectionLogsParams) (int64, error) {
		if err := q.authorizeContext(ctx, policy.ActionDelete, rbac.ResourceSystem); err != nil {
		return 0, err
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -324,6 +324,10 @@ func (s *MethodTestSuite) TestAuditLogs() {
		dbm.EXPECT().DeleteOldAuditLogConnectionEvents(gomock.Any(), database.DeleteOldAuditLogConnectionEventsParams{}).Return(nil).AnyTimes()
		check.Args(database.DeleteOldAuditLogConnectionEventsParams{}).Asserts(rbac.ResourceSystem, policy.ActionDelete)
		}))
		s.Run("DeleteOldAuditLogs", s.Mocked(func(dbm dbmock.MockStore, _ gofakeit.Faker, check *expects) {
		dbm.EXPECT().DeleteOldAuditLogs(gomock.Any(), database.DeleteOldAuditLogsParams{}).Return(int64(0), nil).AnyTimes()
		check.Args(database.DeleteOldAuditLogsParams{}).Asserts(rbac.ResourceSystem, policy.ActionDelete)
		}))
		}

		func (s *MethodTestSuite) TestConnectionLogs() {
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -28,6 +28,8 @@ const (
		// Batch size for connection log deletion. Smaller batches prevent long-held
		// locks that could impact concurrent database operations.
		connectionLogsBatchSize = 1000
		// Batch size for audit log deletion.
		auditLogsBatchSize = 1000
		// Telemetry heartbeats are used to deduplicate events across replicas. We
		// don't need to persist heartbeat rows for longer than 24 hours, as they
		// are only used for deduplication across replicas. The time needs to be
Expand DownExpand Up		@@ -130,10 +132,27 @@ func New(ctx context.Context, logger slog.Logger, db database.Store, vals *coder
		}
		}

		var purgedAuditLogs int64
		auditLogsRetention := vals.Retention.AuditLogs.Value()
		if auditLogsRetention == 0 {
		auditLogsRetention = vals.Retention.Global.Value()
		}
		if auditLogsRetention > 0 {
		deleteAuditLogsBefore := start.Add(-auditLogsRetention)
		purgedAuditLogs, err = tx.DeleteOldAuditLogs(ctx, database.DeleteOldAuditLogsParams{
		BeforeTime: deleteAuditLogsBefore,
		LimitCount: auditLogsBatchSize,
		})
		if err != nil {
		return xerrors.Errorf("failed to delete old audit logs: %w", err)
		}
		}

		logger.Debug(ctx, "purged old database entries",
		slog.F("expired_api_keys", expiredAPIKeys),
		slog.F("aibridge_records", purgedAIBridgeRecords),
		slog.F("connection_logs", purgedConnectionLogs),
		slog.F("audit_logs", purgedAuditLogs),
		slog.F("duration", clk.Since(start)),
		)

Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -1061,3 +1061,209 @@ func TestDeleteOldAIBridgeRecords(t *testing.T) {
		require.NoError(t, err)
		require.Len(t, newToolUsages, 1, "near threshold tool usages should not be deleted")
		}

		func TestDeleteOldAuditLogs(t *testing.T) {
		t.Parallel()

		now := time.Date(2025, 1, 15, 7, 30, 0, 0, time.UTC)
		retentionPeriod := 30 * 24 * time.Hour
		afterThreshold := now.Add(-retentionPeriod).Add(-24 * time.Hour) // 31 days ago (older than threshold)
		beforeThreshold := now.Add(-15 * 24 * time.Hour) // 15 days ago (newer than threshold)

		testCases := []struct {
		name string
		retentionConfig codersdk.RetentionConfig
		oldLogTime time.Time
		recentLogTime *time.Time // nil means no recent log created
		expectOldDeleted bool
		expectedLogsRemaining int
		}{
		{
		name: "RetentionEnabled",
		retentionConfig: codersdk.RetentionConfig{
		AuditLogs: serpent.Duration(retentionPeriod),
		},
		oldLogTime: afterThreshold,
		recentLogTime: &beforeThreshold,
		expectOldDeleted: true,
		expectedLogsRemaining: 1, // only recent log remains
		},
		{
		name: "RetentionDisabled",
		retentionConfig: codersdk.RetentionConfig{
		AuditLogs: serpent.Duration(0),
		},
		oldLogTime: now.Add(-365 * 24 * time.Hour), // 1 year ago
		recentLogTime: nil,
		expectOldDeleted: false,
		expectedLogsRemaining: 1, // old log is kept
		},
		{
		name: "GlobalRetentionFallback",
		retentionConfig: codersdk.RetentionConfig{
		Global: serpent.Duration(retentionPeriod),
		AuditLogs: serpent.Duration(0), // Not set, should fall back to global
		},
		oldLogTime: afterThreshold,
		recentLogTime: &beforeThreshold,
		expectOldDeleted: true,
		expectedLogsRemaining: 1, // only recent log remains
		},
		}

		for _, tc := range testCases {
		t.Run(tc.name, func(t *testing.T) {
		t.Parallel()

		ctx := testutil.Context(t, testutil.WaitShort)
		clk := quartz.NewMock(t)
		clk.Set(now).MustWait(ctx)

		db, _ := dbtestutil.NewDB(t, dbtestutil.WithDumpOnFailure())
		logger := slogtest.Make(t, &slogtest.Options{IgnoreErrors: true})

		// Setup test fixtures.
		user := dbgen.User(t, db, database.User{})
		org := dbgen.Organization(t, db, database.Organization{})

		// Create old audit log.
		oldLog := dbgen.AuditLog(t, db, database.AuditLog{
		UserID: user.ID,
		OrganizationID: org.ID,
		Time: tc.oldLogTime,
		Action: database.AuditActionCreate,
		ResourceType: database.ResourceTypeWorkspace,
		})

		// Create recent audit log if specified.
		var recentLog database.AuditLog
		if tc.recentLogTime != nil {
		recentLog = dbgen.AuditLog(t, db, database.AuditLog{
		UserID: user.ID,
		OrganizationID: org.ID,
		Time: *tc.recentLogTime,
		Action: database.AuditActionCreate,
		ResourceType: database.ResourceTypeWorkspace,
		})
		}

		// Run the purge.
		done := awaitDoTick(ctx, t, clk)
		closer := dbpurge.New(ctx, logger, db, &codersdk.DeploymentValues{
		Retention: tc.retentionConfig,
		}, clk)
		defer closer.Close()
		testutil.TryReceive(ctx, t, done)

		// Verify results.
		logs, err := db.GetAuditLogsOffset(ctx, database.GetAuditLogsOffsetParams{
		LimitOpt: 100,
		})
		require.NoError(t, err)
		require.Len(t, logs, tc.expectedLogsRemaining, "unexpected number of logs remaining")

		logIDs := make([]uuid.UUID, len(logs))
		for i, log := range logs {
		logIDs[i] = log.AuditLog.ID
		}

		if tc.expectOldDeleted {
		require.NotContains(t, logIDs, oldLog.ID, "old audit log should be deleted")
		} else {
		require.Contains(t, logIDs, oldLog.ID, "old audit log should NOT be deleted")
		}

		if tc.recentLogTime != nil {
		require.Contains(t, logIDs, recentLog.ID, "recent audit log should be kept")
		}
		})
		}

		// ConnectionEventsNotDeleted is a special case that tests multiple audit
		// action types, so it's kept as a separate subtest.
		t.Run("ConnectionEventsNotDeleted", func(t *testing.T) {
		t.Parallel()

		ctx := testutil.Context(t, testutil.WaitShort)
		clk := quartz.NewMock(t)
		clk.Set(now).MustWait(ctx)

		db, _ := dbtestutil.NewDB(t, dbtestutil.WithDumpOnFailure())
		logger := slogtest.Make(t, &slogtest.Options{IgnoreErrors: true})
		user := dbgen.User(t, db, database.User{})
		org := dbgen.Organization(t, db, database.Organization{})

		// Create old connection events (should NOT be deleted by audit logs retention).
		oldConnectLog := dbgen.AuditLog(t, db, database.AuditLog{
		UserID: user.ID,
		OrganizationID: org.ID,
		Time: afterThreshold,
		Action: database.AuditActionConnect,
		ResourceType: database.ResourceTypeWorkspace,
		})

		oldDisconnectLog := dbgen.AuditLog(t, db, database.AuditLog{
		UserID: user.ID,
		OrganizationID: org.ID,
		Time: afterThreshold,
		Action: database.AuditActionDisconnect,
		ResourceType: database.ResourceTypeWorkspace,
		})

		oldOpenLog := dbgen.AuditLog(t, db, database.AuditLog{
		UserID: user.ID,
		OrganizationID: org.ID,
		Time: afterThreshold,
		Action: database.AuditActionOpen,
		ResourceType: database.ResourceTypeWorkspace,
		})

		oldCloseLog := dbgen.AuditLog(t, db, database.AuditLog{
		UserID: user.ID,
		OrganizationID: org.ID,
		Time: afterThreshold,
		Action: database.AuditActionClose,
		ResourceType: database.ResourceTypeWorkspace,
		})

		// Create old non-connection audit log (should be deleted).
		oldCreateLog := dbgen.AuditLog(t, db, database.AuditLog{
		UserID: user.ID,
		OrganizationID: org.ID,
		Time: afterThreshold,
		Action: database.AuditActionCreate,
		ResourceType: database.ResourceTypeWorkspace,
		})

		// Run the purge with audit logs retention enabled.
		done := awaitDoTick(ctx, t, clk)
		closer := dbpurge.New(ctx, logger, db, &codersdk.DeploymentValues{
		Retention: codersdk.RetentionConfig{
		AuditLogs: serpent.Duration(retentionPeriod),
		},
		}, clk)
		defer closer.Close()
		testutil.TryReceive(ctx, t, done)

		// Verify results.
		logs, err := db.GetAuditLogsOffset(ctx, database.GetAuditLogsOffsetParams{
		LimitOpt: 100,
		})
		require.NoError(t, err)
		require.Len(t, logs, 4, "should have 4 connection event logs remaining")

		logIDs := make([]uuid.UUID, len(logs))
		for i, log := range logs {
		logIDs[i] = log.AuditLog.ID
		}

		// Connection events should NOT be deleted by audit logs retention.
		require.Contains(t, logIDs, oldConnectLog.ID, "old connect log should NOT be deleted by audit logs retention")
		require.Contains(t, logIDs, oldDisconnectLog.ID, "old disconnect log should NOT be deleted by audit logs retention")
		require.Contains(t, logIDs, oldOpenLog.ID, "old open log should NOT be deleted by audit logs retention")
		require.Contains(t, logIDs, oldCloseLog.ID, "old close log should NOT be deleted by audit logs retention")

		// Non-connection event should be deleted.
		require.NotContains(t, logIDs, oldCreateLog.ID, "old create log should be deleted by audit logs retention")
		})
		}
Original file line number	Diff line number	Diff line change
Expand Up		@@ -253,3 +253,24 @@ WHERE id IN (
		ORDER BY "time" ASC
		LIMIT @limit_count
		);

		-- name: DeleteOldAuditLogs :one
		-- Deletes old audit logs based on retention policy, excluding deprecated
		-- connection events (connect, disconnect, open, close) which are handled
		-- separately by DeleteOldAuditLogConnectionEvents.
		WITH old_logs AS (
		SELECT id
		FROM audit_logs
		WHERE
		"time" < @before_time::timestamp with time zone
		AND action NOT IN ('connect', 'disconnect', 'open', 'close')
		ORDER BY "time" ASC
		LIMIT @limit_count
		),
		deleted_rows AS (
		DELETE FROM audit_logs
		USING old_logs
		WHERE audit_logs.id = old_logs.id
		RETURNING audit_logs.id
		)
		SELECT COUNT(deleted_rows.id) AS deleted_count FROM deleted_rows;