0

We have a SP2013 version and in all the site collections they have enabled the auditing. Some business users pull the audit report every month to see the traffic to their sites using "Run custom reports" link under Audit Reports. From last couple of months, the reports are just pulling the information from previous day not entire month. Usage logs are cleared every night for the previous day without considering the settings in either CA or site collections. So in custom report if I run a report for last week, I get an error saying "Report contain no data". I get data only if I include todays date.

This happens in all the site collections in the farm.

Troubleshooting I have done so far.

  • Making sure auditing is enabled in CA & Site collection level. Audit purge/trimming is set to 30 days at both places.
  • No issues with the timer jobs for Usage service application.
  • No issues with the search/search history.
  • Logs are pulled into database successfully every 5 min.
  • Logs doesn’t have much information about auditing.
  • Powershell commands $site.Audit.getentries() also shows just previous day data.

Any pointers for troubleshooting is greatly appreciated.

1

Check if there is any third-party application runs a delete query against the AuditData database to delete audit logs.

Try to use SQL Profiler to determine whether a delete query actually deletes the audit data from the AuditData database.

More information refer to the article:

Audit logging is deleted even though audit data retention is enabled in SharePoint

  • In fact in our case the external application was deleting the audit data. Thank you for the information on the Microsoft article. – user57156 Jan 5 '18 at 16:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.