Audit Logs - Document Library Folders are also counted

Question

I have enabled Audit Logging for a MOSS 2007 site. This was done primarily to get reports for a document library which has folders and files inside them.

Everything works fine except that for every file download (or open) the hit count is increased for the folder too.

Suppose if I download a file under Folder 1 (Folder1\file.ppt). Logs shows count one for Folder1 and count one Folder1\file.ppt

Even if I try to download the file directly without navigating through folders the count is increased for folder. Example. I download file www.sharepointsite.com\documentlibrary\Folder1\file.ppt

The log shows count two for Folder1 and Count two for Folder1\file.ppt

Is this normal?

Answer 1

I'll opine that yes it is normal. Here is why: The concept of files and folders exists purely for our convenience. There really aren't a series of folders on the filesys, rather, it's all crammed in the database.

Now what's going on with the folder is more closely related to what you need to do to pull a file out of a .zip archive. First you got to get the .zip, open it, then get out the file within it. Of course, we're still talking about 'everything is in the database', so it isn't a perfect example, but I think it provides a close enough match.

So the "folder", it ain't a folder at all; it's just a pointer. So the system is logging that you downloaded the pointer, and then downloaded another item thereafter. It just so happened that what you downloaded next was a reference within that pointer. Folder. File. Two hits.

Answer 2

to be honest I wouldnt know, but im taking a shot here.... I would gess that its logging not just the parent but also the child/file that you open. That said you need to find out what kind of audit logging you have enabled on your site. Also audit log OOB is kinda broken and doesnt work properly as you have found out. I had a quick lookup and found a great article on msdn on logging:

http://msdn.microsoft.com/en-us/library/bb397403(office.12).aspx

its very big as you can customise it but I would think this is what your looking for:

Item-Level Auditing with SharePoint Server 2007

http://msdn.microsoft.com/en-us/library/bb397403(office.12).aspx#MOSS2007ItemLevelAudit_ItemLevelAuditingACustomAuditingSolution

Item-Level Auditing

http://msdn.microsoft.com/en-us/library/bb397403(office.12).aspx#MOSS2007ItemLevelAudit_ItemLevelAuditing

Having said that and shown you that I wouldnt still know if its possible as that feature was pulled by ms for some reason, I dunno i think it could of been taxing on the server?

alas all is not failed you also have this great article on the subject:

http://msdn.microsoft.com/en-us/library/bb418730%28office.12%29.aspx

and

http://books.google.co.uk/books?id=Lq_xG4z3cYwC&pg=PA110&lpg=PA110&dq=sharepoint+2007+audit+Opening+or+downloading+documents&source=bl&ots=DMbki_8VUQ&sig=n6ZvCTp-DaqdW-4_ndrytTaQZUk&hl=en#v=onepage&q=sharepoint%202007%20audit%20Opening%20or%20downloading%20documents&f=false

have you looked at audit policy?

Viewing Editing Deletion Check in /Check out

the options are;

Opening or downloading documents, viewing items in lists, or viewing item properties

Editing items

Checking out or checking in items

Moving or copying items to another location in the site

Deleting or restoring items

you can check anyone of these for the list by going to the list, then click on settings, then select list settings, under permissions and managment select information managment policy settings, check the radio button define a policy and click ok, fill in info as required but the part you want is Auditing so check Enable Auditing if it isnt already, You should get the selection above to choose from. If you want it to do more or less than that then you will need to make your own as iv shown above.

hope this directs you into the right direction :)