4

I have used Search-UnifiedAuditLog Powershell command to view all SharePoint file operations (especially the file views) across all sites. Does anybody know how to filter results only to a given site collection? I need to be able to view all file views under a particular site collection.

As per the documentation, -ObjectIds parameter takes Site url as the parameter. But when I passed the site url, it only gives results for the home page excluding any children.

1
  1. On the Site actions menu Site Actions Menu , click Site settings.
  2. In the Site Collection Administration section, select Audit log reports.
  3. On the View Auditing Reports page, select the report that you want.
  4. Type or Browse to the library where you want to save the report and click OK.
  • Sorry, that doesn't give me enough details. Especially the file views. I am quite happy with what I get from "Search-UnifiedAuditLog", but just need to know how to filter for single site collection. – user2560429 Jun 16 '17 at 3:50
1

I don't know how the output of Search-UnifiedAuditLog looks like, maybe filtering the output by using Select-String:

Search-UnifiedAuditLog .... | Select-String -Pattern <regexPattern>

If you provide an example output, then I could help with the regex.

1
Search-UnifiedAuditLog -StartDate 06/11/2017 -EndDate 06/14/2017 -SessionId "UnifiedAuditLogSearch3" -SessionCommand ReturnNextPreviewPage | Export-Csv "C:\result.csv"

The above commandlet is providing useful properties like Operations,UserId,RecordType. but our required data comes in AuditData property, below is the given format,

{"CreationTime":"2017-06-13T21:30:58","Id":"cdc54957-4b41-4209-8697-1636d5f338b1","Operation":"PasswordLogonInitialAuthUsingPassword","OrganizationId":"53ba9c58-11f4-405e-9c0c-1231231231","RecordType":9,"ResultStatus":"success","UserKey":"11232321313765932137393036@adm***.onmicrosoft.com","UserType":0,"Version":1,"Workload":"AzureActiveDirectory","ClientIP":"12.22.11.111","ObjectId":"admin@adm***.onmicrosoft.com","UserId":"admin@***.onmicrosoft.com","AzureActiveDirectoryEventType":0,"Client":"cbainprod","LoginStatus":0,"UserDomain":"***.onmicrosoft.com"}

I am not able to sort it out the required data alone..

If a GUI tool is convenient for you then I would recommend 'AdminDroid Office 365 Reporter'.

There is a separate report in the tool to view all the activities related to SharePoint files. Further, this report allows you to setup a custom filter to view records specific to the particular site collection.

Steps to filter by site collection:

  1. Go to Audit > SharePoint > File Changes > All Activites, This will display the report of all the activities performed on your SharePoint files.

  2. Find the filter option above the table header (Filter option will be available only if you have any data in the report.) and choose 'Create Filter' option.

  3. This will show you the advanced filtering options. Just select 'Site URL' column and specify your site collection name and save the filter.

Now you can easily filter the changes as per site collection and you can schedule this report if you need to check this report periodically.

If you would like to check and confirm your requirement, checkout cool demo of this tool

0

Please follow the below steps to achieve:

  1. Go to Central Administration -> Manage Service Applications
  2. Choose Secure Store Service
  3. Then Click on the Properties in the Ribbon
  4. In the Enable Audit option Select the Check Box Audit Log Enabled
  5. Go to Site Settings -> Site Collection Administration -> Site Collection Audit Settings

Here are few more articles for your reference:

https://support.office.com/en-us/article/View-audit-log-reports-4293E8D5-4E7D-4201-B8AC-C8E63A100131

https://support.office.com/en-us/article/View-audit-log-reports-b37c5869-1b47-4a82-a30d-ea20070fe527?CorrelationId=37fa0ffd-cdf5-4355-b60c-6b1b0ded41ac&ui=en-US&rs=en-US&ad=US&ocmsassetID=HA102772739

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.