Deleting Old Audit Files 
The security audit log saves its audits to a corresponding audit file on a daily basis. Depending on the size of your SAP system and the filters specified, you may be faced with an enormous quantity of data within a short period of time.
Recommendation
We recommend archiving your audit files on a regular basis and deleting the original files as necessary.
Use this procedure to delete old audit files. You can either delete the files from all application servers or from only the local server where you are working. If an application server is not currently active, it will be included in the next reorganization.
Caution
This procedure only deletes the audit log file(s)! It does not perform any other administrative tasks such as archiving. If archives are necessary for future references, you must manually archive them before deleting.
Note
You cannot purge files that are less than 3 days old!
Procedure
To access the security audit log reorganization tool from the SAP standard menu, choose
Tools 
Administration Monitor Security Audit
Log Reorganization 
(transaction SM18).The Security Audit: Delete Old Audit Logs screen appears.
Enter the Minimum age of files to delete (default = 30 days).
This value must be >= 3.
Activate the On all active instances indicator to delete the audit files from all application servers. Leave the indicator blank if you only want to delete the files from the local application server.
Activate the Simulation Only indicator if you do not actually want to delete the files. In this case, the action is only simulated.
Choose
Program Execute .
Result
The system deletes the corresponding audit files (unless you chose to simulate). You receive a list showing how many files were deleted and how many were retained on each application server.