1

We use built-in SharePoint 2013 Audit Log functionality to track accessed reports and documents. Audit Log reports are mission critical for us.

SharePoint's content viewing report shows some audit log records, however I noticed that some of the requests are missing on the report.

For example; I opened a document with a particular user. Then I expect to see this audit log in the reports but there was no such record.

What is the problem here? How can I investigate the issue?

Improve this question
  • 1
    The requests are batched and processed last I knew, so there is a bit of a delay in between when you preformed the action and when it should appear on the audit log reports. – Eric Alexander Nov 18 '15 at 17:52
  • Yes, I'm aware of this. I checked the reports the day after. Some of the requests were in the report and some of them not. Can it be related with security issue or document type? Do you have any idea? – doganak Nov 18 '15 at 22:27
0

I'm not sure about an official reference but I thought they were batched as well. I would check back and see if that even was eventually registered.

Disclaimer - touching the SharePoint Databases is unsupported

The audit data is stored in a table in the content database. If you wanted to mess around with that I recommend restoring a backup to another instance.

If you want to monitor it - you can start up SQL Profiler and try capture items as they are written to the table.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.