Hello @webbm,
I see perfectly where are you coming from. And I fully subscribe to the great recomendations and experience provided by @AndrewHowell
The SAS auditing, as any other auditing in other systems, consumes space and needs to be archived and clean once they are not directly needed anymore.
I truly think that, first, it would be very useful for you to understand what happens on SAS backstage, before providing a complete answer.
Those components are part of the SAS Environment Manager Service Architecture Framework (link), more specifically from the Environment Manager Agent, ACM and APM.
Understanding SAS Environment Manager Service Management Architecture (link)
Paper 064-2014: Log entries, Events, Performance Measures, and SLAs: Understanding and Managing your SAS® Deployment by Leveraging the SAS® Environment Manager Data Mart (link)
The part you would need to know is that:
SAS Environment Manager agent feeds the SAS Environment Manager server, and this web app will feed the WIP database and a SAS internal process will feed the SAS Environment Manager Datamart. Once the data collected by the agents are stored in WIP, the logs are not needed. Perhaps you would need to keep them archived due to company policies. This would cover the last location from your list.
APM and ACM basically extend the logs from your SAS services, such as Metadata, Object Spawner, Workspace Srv, STP srv, etc. A nightly job will run every night, collecting the data and filling in WIP and the SAS Environment DataMart. Again, once collected, you can handle them safely. This would cover your first locations on your list.
Knowing this, you can create and customise the retention period of your logs in your system. SAS already does this, partially, out-of-the-box for you:
/Lev1/Web/SASEnvironmentManager/emi-framework/Archive/logs_processed_date.zip is an actual archived collection of logs.
SAS will also have a retention period on your audited data. You will want to review and understand well this part, specially if you will clean the original locations of the logs:
http://support.sas.com/kb/58/599.html
https://blogs.sas.com/content/sgf/2016/01/26/going-visual-analytics-audit-data-archiving/
Hope it helps.
Kind regards,
Juan
... View more