How to audit one specific list/library?

Question

I thought this was simple: I went to list settings --> Information Management Policy Settings, clicked on "item", and on the "edit policy" screen I selected to "enable auditing" and then selected two events: "editing items" and "checking out or checking in". After setting this up and adding and editing some list items, there was nothing in the audit logs (site settings --> audit log reports --> content modifications).

Then, I enabled auditing via site settings --> site collection audit settings, and checked the "editing items" box. At this point, all lists/libraries were being audited and the report had data for all lists/libraries.

So, what exactly does the "enable auditing" in the list settings do? What else do I need to do to audit one particular list?

I tried this in both SharePoint 2013 Enterprise on-prem as well as Office 365 with the same results.

Answer 1

Auditing and Tracking who has opened/ deleted/ edited, etc. a document in SharePoint 2010 Library along with the Timestamp.

Setting up the auditing

1. Before auditing, the Reporting feature under Site Collection Feature should be activated.

Under Site Actions -> Site Settings -> Site Collection Administration -> Site Collection Features -> Reporting

2. If you cannot find the Site collection policies option under Site Settings ->Site Collection Administration then you must enable the Library and Folder Based Retention Feature.

Under Site Actions -> Site Settings -> Site Collection Administration -> Site Collection Features -> Library and Folder Based Retention

3. To start tracking who and when has viewed / downloaded, etc.., the documents, first you have to create a Site Collection Policy as mentioned below.

Site Actions -> Site Settings -> Site Collection Policies

Create new policy -> Provide Name and check the box for Enable Auditing Select Events you would like to audit -> Click OK

4. Then, you have to setup the Document Library / List that you would like to audit

Set up the Document Library / List which requires auditing. Go to List Settings or Library Settings of the List / Document Library you would like to audit.

Click on Information Management Policy Settings. Select the content type that you want to set the policy for auditing. Under use site collection policy of that particular content type, select the policy you had defined in first step and click OK.

Note: That’s it - from this point your library / list is set for auditing - any actions will be logged.

To view the results

Go to Site Actions -> Site Settings - > Site Collection Administration ->Audit log Reports.

Under Custom Reports click on "Run a custom report". However you can use other reports also based on your requirement.

Select checkbox "Restrict this Report to" and select corresponding web application and List / Library name.

You can select various filters (start date, end date, users), though these are optional but it’s better to use them as they improve the report performance.

Select the events you would like to see the report for and click ok

Note: Go to the specified location used for saving the report and view the Audit report.

Answer 2

Ok, so the issue is that SharePoint doesn't(?) audit inserts. I created 10 new list items and edited one of them, and that one showed up in the audit log. I uploaded several docs to a library, edited one of them, and only the one showed up in the audit log. (and interestingly, editing the doc in word online made several edits appear in the log).

Answer 3

Finally Microsoft made the appropriate updates/upgrades, and all audit logs are available on 2016/365 under Admin Center-> Security & Compliance -> Search & Investigation. Excellent Feature for Audit, eDiscovery, Policies, Security, Data Governance, in compliance with ISO 27001. You can create alerts for specific items(Documents) or lists, or library, and all the actions will be delivered in your mail box, check in/out, view, modified...