Tag Info

Hot answers tagged

11

There is no Auditing user interface in WSS3 or SharePoint Foundation. A (very) basic interface and reporting facility is part of MOSS 2007 and SharePoint Server 2010. However, you can enable auditing programmatically on SharePoint Foundation. This doesn't provide any reporting facility, which you will need to write yourself. As one of the authors behind a ...


9

Gary Lapointe and Mathew McDermott recently published an article on this topic in SharePointPro magazine. It is available online here: http://www.sharepointpromag.com/article/sharepoint/monitor-sharepoint-user-profile-changes-129846 Synopsis of the article: First you enable logging via the STSADM tool (no PS available for this) stsadm -o ...


8

It sounds like you are reinventing the wheel. SharePoint ships with an Auditing infrastructure, which although flawed, will probably give you what you need. Have a look at the following: When using WSS3 or SharePoint Foundation you don't get a user interface so you will need to set and query it programmatically. (2007 article, but it works the same in ...


6

You need to change the SPAudit.AuditFlags property programmatically (see the linked article for examples).


6

I know this is an old post now but I had the same requirement and I have just achieved it programmatically using PowerShell: 1) Turn on item level auditing. # Select site $web = Get-SPWeb http://yoursiteurlhere # Select document library $library = $web.lists | Where { $_.Title -eq "Your Doc. Lib. Title Here" } # Select and loop through library items ...


5

Best way to do this is use the OOTB auditing features or use an event reciever to record the deletion somewhere using code. http://msdn.microsoft.com/en-us/library/bb397403(v=office.12).aspx


4

You could enable audit on the 'View' events of the SPListItem. You can then query with something like: SPSite site = ... SPListItem item = ... SPAuditQuery query = new SPAuditQuery(site); query.RestrictToListItem(item); SPAuditEventType[] eventTypes = new SPAuditEventType[] { SPAuditEventType.View }; SPAuditEntryCollection auditLog = ...


4

It looks like it's not possible without manual filtering. All the entries are stored in the site collection database in the table dbo.AuditData so GetEntries is just a method to get the data from the table. Let's look at the table structure: [dbo].[AuditData]( [SiteId] [uniqueidentifier] NOT NULL, [ItemId] [uniqueidentifier] NOT NULL, ...


4

Opening a web does not cause an entry to be created in the SharePoint audit log. Assuming you have "view" auditing turned on at the web or site collection level that will log views (opens) of documents, list items, and item properties. Extend your code above to open a file...i.e. SPFile.OpenBinary. That will cause audit entries to be created.


4

First thing, you make sure you are recording the Deletion in your audit log. you can check here Configure audit settings for a site collection Now following events available for audit log reports The following events are available for audit log reports to help you determine who is taking what actions with the content of a site collection: Opened and ...


3

Sharepoint 2010 has the ability to log just about everything ranging from your dog barking to the server has crashed. Not all of it as activated by default though. Have a look at Monitoring > Configure diagnostic logging in your Central Admin. Under SharePoint Portal Server there are a couple which you need to tick: SPS People User Profiles Personal ...


3

You are correct, there is no 'Read' event receiver, but you can create an HTTP Module to (painfully) track that information. See Logging document library downloads with HttpModule. Alternatively the 'View', 'Update' and 'Delete' Audit events will give you this information, but auditing in SharePoint is pretty broken. For example Updates are also logged when ...


3

This is correct. Properties.ListItem is empty on ItemDeleted, because this is after event and it is fired when the item is already deleted. You should be using ItemDeleting method if you need list item, because it is fired before item is deleted. This is also correct. There are no event receivers for recycle bin actions.


3

your doing nothing to the web object? did you mean that you want to write to the web audit log event? using System; using Microsoft.SharePoint; namespace Audit.Tests { internal class Program { private static void Main() { const string siteURL = "http://somesite"; const int n = 50000; const int k ...


2

There is a codeplex project that toggles this setting for SharePoint Foundation via a Feature. It also provides some nifty UI for viewing the Audit Log in the browser- including a useful feature to view log entries for a single item from a ECB menu option. AuditLog for SharePoint 2010 Foundation http://auditlogsp.codeplex.com/


2

Yes, it is possible. Enable audit logging on site collection level. http://www.sharepointedutech.com/2011/02/14/setting-up-audit-logging-in-sharepoint-2010/


2

If I understand you correctly, the SharePoint audit possibilities don't fulfill your needs? Can you please tell us on what area you need extra functionality? at http://office.microsoft.com/en-us/sharepoint-server-help/view-audit-log-reports-HA102039795.aspx the functionalities are described. Is your requirement to get that auditlog data into some external ...


2

As one of the developers behind a popular SharePoint Auditing solution, let me share my 2 cents. Auditing in SharePoint is (deeply) flawed and you are right to be concerned about performance, specifically: Audit logs grow out of control as too much information is logged by default in certain areas, (and too little in other areas). For example requests to ...


2

You should definitely use the ItemDeleting event, log the delete action, and then remove the log entry if the item is restored from the recycle bin. It's not a perfect solution, but there simply isn't an event to capture items being purged from the recycle bins. EDIT: I went back and checked something I wrote a year or so ago...no event fires when the ...


2

You should use PowerShell for provisioning your service apps. For once, you do not always know where your SA's will end up depending on farm topology (dedicated application server etc), so automated farm configuration should be done in PowerShell. An example (taken from Todd Carter's blog, but there are several examples out there) Write-Host "Creating Web ...


2

While Auditing is not available from the UI in Foundation, you can access the Audit functionality and turn it on via the object model: http://social.msdn.microsoft.com/Forums/en/sharepoint2010general/thread/53e79142-88c9-48f1-b5a5-a6259c9f6f97 If you notice in this post, Auditing is advertised as a feature of Foundation, but it takes a little extra work to ...


2

If this is what you are facing then you should probably do a comprehensive security review and lock down the permissions on the site(s) in question, removing all but one or two trusted people from the role of Site Collection Administrator and then creating new permissions for other users, either as a different security group, a different permission level or ...


2

Its explained indepth here with images how to use SPAudit ;) http://www.codeproject.com/Articles/431342/Auditing-A-Built-in-Feature-of-SharePoint SPAudit and its members http://msdn.microsoft.com/en-us/library/microsoft.sharepoint.spaudit.aspx members http://msdn.microsoft.com/en-us/library/microsoft.sharepoint.spaudit_members.aspx This is taken from ...


2

On the Site Collection that you want to track reading, go toSite Actions –> Site Settings –> Site Collection Administration –> Site Collection audit settings. Under the Document and Items section you can enable the events you would like to audit: Reference: How to enable Audit functionality in SharePoint 2010


2

You cannot use the server side SPAuditQuery api in provider hosted web. You should be able to achieve this in 3 ways: 1) There is SP.ChangeQuery api available on client side to fetch changes done on lists/Document Library level from sharepoint. You can use ChangeQuery class in CSOM. Refer Use of ChangeQuery in CSOM 2) Generate Http Post requests from ...


2

In short, you can't in a supported method as the API requires a valid SPSite object. The supported way of getting around this is to move all sites to a new content database, then abandon the defunct content database.


2

I believe that search indexer crawl results would be logged under whatever user account crawled those docs. So, if the 'System' account is doing the crawling, that would explain things.


2

How about using the built in Content and Structure functionality? http://office.microsoft.com/en-us/sharepoint-server-help/work-with-site-content-and-structure-HA010131723.aspx You find it by: Click Site Actions, and then click Mange Content and Structure. If Manage Content and Structure is not listed, perform the following steps: Point to Site Settings, ...


1

(Sarcastic response with a serious undertone): Yep, look up your security policy documents to determine what roles to restore. :) (More useful response): Nope, when you break permission inheritance and apply level permissions to individual items below a parent, that information is not stored anywhere when deleted. Only option is to recover from a backup.


1

Short of a restore I can't think of a way you could really roll that back. I'd suggest restoring the DB to a test environment then resetting the perms with something to compare to. If you don't have a test environment you could restore the db with a new name and attach it to a new web app in your production environment.



Only top voted, non community-wiki answers of a minimum length are eligible