Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

I would like to use the security audit log report of a site collection, and evaluate the entries e.g. each hour. The focuss lays on actions/events performed on the access rights on the site. Which users are added, deleted, SP groups created, removed etc. This info will be written to a custom list.

Following code can be used to retrieve the events:

SPAuditQuery query = new SPAuditQuery(site);
query.AddEventTrstriction(SPAuditEventType.SecGroupCreate);
query.SetRangeStart(DateTime.Now.AddHours(-1);

SPAuditEntryCollection auditCol = site.Audit.GetEntries(wssQuery);

foreach(SPAuditEntry entry in auditCol)
{
    // Do something with the entries
}
  • When I execute this code every hour with e.g. a timer job how can I make sure not to miss entries which fall just on the hour, and are not picked up the next time the timer job is running?
  • It's probably advisable to clean up this log file on a regular base using (SPAudit.DeleteEntries)?
  • Maybe both points can be combined in one solution e.g. Take the timestamp of the last AuditEntry and delete all entries before this.
share|improve this question
    
could you maybe add a few lines on the business case here? What are you trying to monitor (eg what events) and for what kind of artifacts (eg documents) –  Anders Rask Jun 1 '12 at 12:37

1 Answer 1

Audit logs should be maintained as per capacity planning you have in place (Steve Goldberg gives an example of how to calculate space taken https://www.nothingbutsharepoint.com/sites/itpro/Pages/Best-Practices-for-Auditing-in-SharePoint.aspx).

Only activate it where/when needed and configure trimming as soon (i wouldn't go for an hour as you could have negative impact on the database performance due to high fragmentation and frequent non-important operations) as data is no longer necessary. Another participate in this forum also shared more here How often should the auditing log be cleared to not affect performance?

Data collected is always there unless you trim it, but is as well important to scope appropriately the SPAuditQuery (e.g. Request specific to a list, web, etc. - http://msdn.microsoft.com/en-us/library/microsoft.sharepoint.spauditquery.restricttolist.aspx)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.