Exchange 2010: Purging Mailbox Audit Logs

Despite numerous articles on the subject, and even a warning from the cmdlet itself, I was unable to get -AuditLogAgeLimit to purge existing logs, however, a combination of the cmdlet: Start-ManagedFolderAssistance and Set-Mailbox -AuditLogAgeLimit did work.

So you are running out of space on your database drive / database and you want to purge mailbox audit logs, or at least reduce the amount of data held.

Currently all our user mailboxes have Auditing enabled and set to hold 10 days worth of logs:

[PS] C:> Get-Mailbox | fl *Audit*

Database         : DB05
AuditEnabled     : True
AuditLogAgeLimit : 00:00:00
AuditAdmin       : {Update, Move, MoveToDeletedItems, SoftDelete, HardDelete, FolderBind, SendAs, SendOnBehalf, Create}
AuditDelegate    : {Update, Move, SoftDelete, HardDelete, SendAs, Create}
AuditOwner       : {Move, MoveToDeletedItems, SoftDelete, HardDelete}

To reduce logs down to 5 days for all users (with a custom attribute 3 of “User”):

1. Reduce log age limit:
[PS] C:> Get-Mailbox | ?{$_.CustomAttribute3 -eq “User”} | Set-Mailbox -AuditLogAgeLimit 5.00:00:00 -Force

Exchange prompts for each mailbox, even with -Confirm:$False. To skip this, use -Force.
-AuditLogAgeLimit is in the format D.HH.MM.SS.

2. To see an (almost) imediate effect:
[PS] C:> Start-ManagedFolderAssistant username

Or for all mailboxes:
[PS] C:> Get-Mailbox | ?{$_.CustomAttribute3 -eq “User”} | Start-ManagedFolderAssistant

By almost I mean the process is fairly fast. Depending on size, instant to about 10 minutes. 110545 items were reduced to 0 by the time I finished writing the above.

To view the size and item count in the Audit folder:
[PS] C:> Get-MailboxFolderStatistics username | ?{$_.Name -eq “Audits” -and $_.FolderType -eq “Audits”} | ft Identity, ItemsInFolder, FolderSize -Autosize

Please feel free to leave a comment...