Hi, I've set a filter for the acs database to exclude specific events from being collected. Because I've subsequently set the filter, some of these events are in the acs database now. Is it possible to remove this events via sql query? Will the size of the acs database decrease on deletion of events? Thank you in advance, Marius

Hi John, thanks for your information. Because we have set a retention period of five years, I will change the retention period to one day to clean out the unwanted events and after grooming I will set it back to 1826 days. Will this action have a negative effect on the acs database? But there is no other way to clean the acs database, unless to create a completely new one.

Hi I would be careful with doing this in one hit. Depending on the number of records, the recovery mode of SQL and underlying Disk IO you might find a huge hit on performance and potentially tempDB filling up the disk as grooming takes place. Also, grooming will clear out all events, not just the unwanted events. If you are doing this then I'd suggest that you are better off starting afresh with a new ACS database. If you need to keep data for this long and want to leverage ACS then you might want to consider and evaluate Secure Vantage ACS archiving: http://www.securevantage.com/Resources/ACSResources.aspx Cheers Graham Regards Graham New System Center 2012 Blog! - http://www.systemcentersolutions.co.uk View OpsMgr tips and tricks at http://systemcentersolutions.wordpress.com/

Hi Graham, the acs database is about 16 days old, has accumulated 1.060.771 events (with 973017 unwanted ones, caused by a failure in our audit policy) and has a size of approximately 500MB. It's no problem, that we restart the audit collection afresh. Will I have to go through all the acs collector installation again (delete the collector, then reinstall) to create a new acs database or is there another way?