Hot answers tagged auditing
11
There is no Auditing user interface in WSS3 or SharePoint Foundation. A (very) basic interface and reporting facility is part of MOSS 2007 and SharePoint Server 2010.
However, you can enable auditing programmatically on SharePoint Foundation. This doesn't provide any reporting facility, which you will need to write yourself.
As one of the authors behind a ...
8
Gary Lapointe and Mathew McDermott recently published an article on this topic in SharePointPro magazine. It is available online here:
http://www.sharepointpromag.com/article/sharepoint/monitor-sharepoint-user-profile-changes-129846
Synopsis of the article:
First you enable logging via the STSADM tool (no PS available for this)
stsadm -o ...
7
It sounds like you are reinventing the wheel. SharePoint ships with an Auditing infrastructure, which although flawed, will probably give you what you need.
Have a look at the following:
When using WSS3 or SharePoint Foundation you don't get a user interface so you will need to set and query it programmatically. (2007 article, but it works the same in ...
5
I know this is an old post now but I had the same requirement and I have just achieved it programmatically using PowerShell:
1) Turn on item level auditing.
# Select site
$web = Get-SPWeb http://yoursiteurlhere
# Select document library
$library = $web.lists | Where { $_.Title -eq "Your Doc. Lib. Title Here" }
# Select and loop through library items
...
4
Best way to do this is use the OOTB auditing features or use an event reciever to record the deletion somewhere using code.
http://msdn.microsoft.com/en-us/library/bb397403(v=office.12).aspx
3
Sharepoint 2010 has the ability to log just about everything ranging from your dog barking to the server has crashed.
Not all of it as activated by default though.
Have a look at Monitoring > Configure diagnostic logging in your Central Admin.
Under SharePoint Portal Server there are a couple which you need to tick:
SPS People
User Profiles
Personal ...
3
This is correct. Properties.ListItem is empty on ItemDeleted, because this is after event and it is fired when the item is already deleted. You should be using ItemDeleting method if you need list item, because it is fired before item is deleted.
This is also correct. There are no event receivers for recycle bin actions.
3
You could enable audit on the 'View' events of the SPListItem. You can then query with something like:
SPSite site = ...
SPListItem item = ...
SPAuditQuery query = new SPAuditQuery(site);
query.RestrictToListItem(item);
SPAuditEventType[] eventTypes = new SPAuditEventType[] { SPAuditEventType.View };
SPAuditEntryCollection auditLog = ...
3
You are correct, there is no 'Read' event receiver, but you can create an HTTP Module to (painfully) track that information. See Logging document library downloads with HttpModule.
Alternatively the 'View', 'Update' and 'Delete' Audit events will give you this information, but auditing in SharePoint is pretty broken. For example Updates are also logged when ...
2
There is a codeplex project that toggles this setting for SharePoint Foundation via a Feature. It also provides some nifty UI for viewing the Audit Log in the browser- including a useful feature to view log entries for a single item from a ECB menu option.
AuditLog for SharePoint 2010 Foundation
http://auditlogsp.codeplex.com/
2
If I understand you correctly, the SharePoint audit possibilities don't fulfill your needs? Can you please tell us on what area you need extra functionality? at http://office.microsoft.com/en-us/sharepoint-server-help/view-audit-log-reports-HA102039795.aspx the functionalities are described.
Is your requirement to get that auditlog data into some external ...
2
You should use PowerShell for provisioning your service apps. For once, you do not always know where your SA's will end up depending on farm topology (dedicated application server etc), so automated farm configuration should be done in PowerShell.
An example (taken from Todd Carter's blog, but there are several examples out there)
Write-Host "Creating Web ...
2
Its explained indepth here with images how to use SPAudit ;)
http://www.codeproject.com/Articles/431342/Auditing-A-Built-in-Feature-of-SharePoint
SPAudit and its members
http://msdn.microsoft.com/en-us/library/microsoft.sharepoint.spaudit.aspx
members
http://msdn.microsoft.com/en-us/library/microsoft.sharepoint.spaudit_members.aspx
This is taken from ...
2
If this is what you are facing then you should probably do a comprehensive security review and lock down the permissions on the site(s) in question, removing all but one or two trusted people from the role of Site Collection Administrator and then creating new permissions for other users, either as a different security group, a different permission level or ...
2
As one of the developers behind a popular SharePoint Auditing solution, let me share my 2 cents.
Auditing in SharePoint is (deeply) flawed and you are right to be concerned about performance, specifically:
Audit logs grow out of control as too much information is logged by default in certain areas, (and too little in other areas). For example requests to ...
2
You should definitely use the ItemDeleting event, log the delete action, and then remove the log entry if the item is restored from the recycle bin.
It's not a perfect solution, but there simply isn't an event to capture items being purged from the recycle bins.
EDIT: I went back and checked something I wrote a year or so ago...no event fires when the ...
1
Sorry for late answer...
For your first question, if Audit feature configured in your sharepoint application, you can able to get the reports.
For second question regarding the OOB aduit feature
Please check the below post, it will help you out
http://www.codeproject.com/Articles/431342/Auditing-A-Built-in-Feature-of-SharePoint
Thanks,
Somasekhar Akiri.
...
1
While Auditing is not available from the UI in Foundation, you can access the Audit functionality and turn it on via the object model:
http://social.msdn.microsoft.com/Forums/en/sharepoint2010general/thread/53e79142-88c9-48f1-b5a5-a6259c9f6f97
If you notice in this post, Auditing is advertised as a feature of Foundation, but it takes a little extra work to ...
1
(Sarcastic response with a serious undertone): Yep, look up your security policy documents to determine what roles to restore. :)
(More useful response): Nope, when you break permission inheritance and apply level permissions to individual items below a parent, that information is not stored anywhere when deleted. Only option is to recover from a backup.
1
Short of a restore I can't think of a way you could really roll that back. I'd suggest restoring the DB to a test environment then resetting the perms with something to compare to. If you don't have a test environment you could restore the db with a new name and attach it to a new web app in your production environment.
1
You may want to make sure you are setup to audit the events you are looking to capture. Here is a good overview blog post: http://sharepointknowledgebase.blogspot.com/2010/09/sharepoint2010-site-collection-auditing.html
1
What do you mean by update? Change the data?
If you just need to view the data, some code like this has worked for me:
SPAuditQuery query = new SPAuditQuery(site);
query.AddEventRestriction(SPAuditEventType.View);
query.RestrictToList(list);
SPAuditEntryCollection auditCol = list.Audit.GetEntries(query);
Then you just loop through the auditCol and add ...
1
Audting is one of those things that a lot of people just turn on without thinking about how much data can accumulate in a very short amount of time. When I was doing the BLOB remoting thing we would find customers whose audit data was nearly the size of their BLOB data and in some cases more.
So it's one of those features that IMO you should not turn on ...
1
We have auditing turned on for one of our web applications. Since it can generate a ton of data, we decided to create a separate database within the Sharepoint server. Two times a week, we selectively replicate the data to this other database. This cuts down on the number of items in the log. This allows us to report on the activity going on within the ...
1
If you have list or library, you can simply setup an alert. There are a lot of settings like "new items are added, existing was modified" or "items are deleted" and e-mail can be sended in minutes. (setting says immediately, but it depends on job settings).
Great site for alerts is here ...
1
The quick and easy answer is to turn on audit logging, but I would caution you to carefully consider how you leverage that feature. It can cause considerable bloat in your content databases and IMO should be used as sparingly as possible.
If you're only concerned with deletion then I could encourage you to only enable the "Deleting or restoring items" ...
1
If I understand correctly the task is to audit the users activity.
You can use the SharePoint 2010 auditing feature and then publish the report to a library. The SharePoint Server auditing capabilities allow you to track all activities that occur within the environment. The site collection administrator has the ability to set auditing requirements within ...
1
Since you need to install Farm-Trust solutions (like Timer Jobs), shared hosting solutions are not gong to work. Dedicated hosting solutions are more aligned with running a production SharePoint environment and are going to be very expensive (since they often include production licensing costs).
For temporary testing environments I would suggest either ...
1
Those audit log entries are for list items. I can't tell you why they end up that way but I wrote some code that makes them pretty URLs:
const string LIST_ITEM_SUFFIX = "_.000";
if (docLocation.EndsWith(LIST_ITEM_SUFFIX))
{
// this is a list item with the URL all garbled up at the end
// does not seem to have anything to do with versioning
...
1
You can either disable success audits entirely (Tired of all those "Success Audit" event entries?) or use the Filter function of Event Viewer when you are checking the logs.
Only top voted, non community-wiki answers of a minimum length are eligible
