SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I see this in the Eventdata field of audit log reports for the event 'Audit mask change'


Is there some way to find out what these numbers actually mean? Can the Sharepoint object model be used to find what these numbers mean? MSDN is not very helpful on this topic.

share|improve this question
up vote 1 down vote accepted

To store settings about actions and events that are audited SharePoint uses SPAuditMaskType enumeration.

public enum SPAuditMaskType
   All = -1,
   None = 0,
   CheckOut = 1,
   CheckIn = 2,
   View = 4,
   Delete = 8,
   Update = 16,
   ProfileChange = 32,
   ChildDelete = 64,
   SchemaChange = 128,
   SecurityChange = 256,
   Undelete = 512,
   Workflow = 1024,
   Copy = 2048,
   Move = 4096,
   Search = 8192,

So, if you want to know if a new audit mask includes one of the actions, you can use code like this:

string newAuditMask = "15295";
SPAuditMaskType flags = (SPAuditMaskType)Enum.Parse(typeof(SPAuditMaskType), newAuditMask);
if(flags & SPAuditMaskType.Workflow != SPAuditMaskType.None)
   //mask contains Workflow action 
share|improve this answer
Thanks again Andrew.Your code sample helped a lot. – user1630812 May 30 '13 at 6:09

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.