Hi Mohit,
The default behavior is that messages are automatically expired after a certain configurable amount of time (OverrideTimeToBeReceived) from the audit queue. This will be done by MSMQ itself.
http://docs.particular.net/nservicebus/auditing-with-nservicebus
If you are using Service Control then SC will read the messages from the audit queue, store it internally and then store it in the audit log queue.
So depending on your environment you either have to read the message from the audit or audit.log queue. Just make sure you archive all message data including the headers.
When a message is written to the audit queue you do not really have to wait to archive/backup it as that is what I think you want to do.
With restoring you probably want to read a set of message from your audit archive and send it to the correct endpoint so that it will be processed again?
I dont understand what you are referring to with 'Cleanup msmq'. Could you explain your expectations?
Regards,
Ramon