Archiving with a MS SQL Server DB
We have a large amount of audit data (1 week might result in 100 GB of live SQL data). We archive everything every 7 days. However, this seems to archive everything out to .zip files and remove it form the DB. Our IT security team regularly run reports over periods of weeks. The UI allows you to select any period back in time even if it goes past your archiving cut off of 7 days. this leads to misleading reports as the security team think there were no events for a particular user due to the report but in actual fact the events for that user have been archived. Restoring archives is cumbersome and error prone. Is there no concept of a data warehouse in this product like SCOM ACS or Splunk uses i.e. move older data off to a seperate DB that still allows you to report on from the UI??