Exception at Audit Custom Report

Question

I've run into following issue when i try to execute Audit Custom Report on one of the site collections.

10/19/2012 09:30:02.03  w3wp.exe (0x211C)   0x12D8  SharePoint Foundation   Runtime tkau    Unexpected  System.Runtime.InteropServices.COMException: Error HRESULT E_FAIL has been returned from a call to a COM component.    at System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32 errorCode, IntPtr errorInfo)     at Microsoft.Office.Server.OpenXml.Internal.ByteStream.Write(Byte[] rgb, Int32 offset, Int32 cb)     at System.IO.BufferedStream.Write(Byte[] array, Int32 offset, Int32 count)     at System.IO.StreamWriter.Flush(Boolean flushStream, Boolean flushEncoder)     at System.IO.StreamWriter.Write(String value)     at System.Xml.XmlTextEncoder.WriteEntityRefImpl(String name)     at System.Xml.XmlTextEncoder.Write(String text)     at System.Xml.XmlTextWriter.WriteString(String text)     at System.Xml.XmlWriter.WriteElementString(String localName, String ns, String value)     at Microsoft.Office.Server.OpenXml.Internal.Excel.ExcelStringTable.GetStringAtom(String str, Boolean bIsUniqueString)     at Microsoft.Office.RecordsManagement.Reporting.ExcelOpenXmlReportGenerator.<>c__DisplayClass16.<WriteCellStringValue>b__15(XmlTextWriter _xmlwrtr)     at Microsoft.Office.RecordsManagement.Reporting.ExcelOpenXmlReportGenerator.WriteWorksheetCell(XmlTextWriter xmlwrtr, String strCellId, WriteXmlData delWrtCellAttribs, WriteXmlData delWrtCellValue)     at Microsoft.Office.RecordsManagement.Reporting.AuditReportGenerator.<>c__DisplayClass21.<OnInjectDataRow>b__1e(XmlTextWriter xmlwrtr)     at Microsoft.Office.RecordsManagement.Reporting.ExcelOpenXmlReportGenerator.WriteWorksheetRow(XmlTextWriter xmlwrtr, String strRowNumber, String strNumColumns, WriteXmlData delWrtCells)     at Microsoft.Office.RecordsManagement.Reporting.AuditReportGenerator.OnInjectDataRow(String[] rgstrColData)     at Microsoft.Office.RecordsManagement.Reporting.ReportData.GenerateNextReport()     at Microsoft.Office.RecordsManagement.Reporting.ReportBase.AggregateReports(Hashtable query, SPFolder folder, ReportNameGenerator reportNameGenerator)     at Microsoft.Office.RecordsManagement.Reporting.ApplicationPages.CustomizeReport.OKBtn_Click(Object sender, EventArgs e)     at System.Web.UI.WebControls.Button.OnClick(EventArgs e)     at System.Web.UI.WebControls.Button.RaisePostBackEvent(String eventArgument)     at System.Web.UI.Page.RaisePostBackEvent(IPostBackEventHandler sourceControl, String eventArgument)     at System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)   367f6a05-977b-41cb-8624-55b8fc307034    

There is nothing more in the logs under this correlation id except OfficePackageLibrary initializing and OfficePackageLibrary initialized message 5 seconds before. Exception is thrown right after running the reprot.

I don't have direct access to environment, where problem occurs,that's why i would like you to ask, where should i look for the reason to this error.

The only thing that I found similar to this error was

http://social.msdn.microsoft.com/Forums/br/sharepoint2010general/thread/e7f1ef13-6306-47d5-a421-2f4efe554341

http://www.dotnetmafia.com/blogs/dotnettipoftheday/archive/2008/05/01/error-hresult-e-fail-has-been-returned-from-a-call-to-a-com-component.aspx

SharePoint is two server farm (db+webfront), i expect that there is a lot of entries in the audit logs.

Answer 1

Have to tried to audit sharepoint with LOGbinder instead? It will allow you to send SharePoint audit events to the Windows Security Log or application log or to a syslog server where your SIEM can then run those custom reports you're looking for.