I've been searching for an answer the past few weeks but I can't figure out where these files are coming from. On the server that hosts our SP sites and services, there is a directory called C:\TempPath. When I first stumbled upon this, it had over 6m+ files in it. After removing the directory, it quickly reappeared and has grown to over 16k+ files now. Every single file is a GUID (i.e. "95007211-da72-4a64-b7a6-bcca3ae8adc5") without a file extension. There is a single file in this directory called startTime.txt which simply contains a time stamp of when the directory was recreated.

Every time I add, update, or delete a document in SharePoint, a new file appears in this directory with these details.

Here is what the files all look like:

<FILETAG>SPAudit0</FILETAG> <OPT>MetaData Updated</OPT> <NAME>MyFile.pdf</NAME> <LOCATION>https://FQDN.com/MySiteName/Documents/MyFilePath/MyFile.pdf</LOCATION> <PERMNAME>null</PERMNAME> <UNAME>null</UNAME> <GNAME>null</GNAME> <WHO>John Doe</WHO> <WHEN>2019/5/16 09:05:18</WHEN> <SNAME>MySiteName</SNAME> <OBJTYPE>Document</OBJTYPE> <SURL>https://FQDN.com/MySiteName</SURL> <DETAILS>[Comments] MetaData Updated <SLASH_R> <SLASH_N> From: **Prior Value** <SLASH_R> <SLASH_N> To: **New Value** </DETAILS> <AURL>null</AURL>

Can anybody identify what this is? I've checked the gatherer and diagnostic service file paths (both of which are stored on a secondary drive (E:)), I've searched the registry for this file path, and I've gone through every piece of configuration I know of. My best guess is that this is something not well known or well hidden from documentation.

Hopefully the file contents will look familiar to someone else.

  • C:\TempPath is not a default Temp location for windows, so, this looks like a custom functionality. I would suggest to check the custom functionalities in your code, like event listeners etc. to see if there is any reference. – UBK May 25 '19 at 16:03
  • @UBK The files are owned by IUSR (IIS) and the only thing running is SharePoint. It's definitely not a default path but I can't find any references to it within configurations, registry, or IIS. – hack3rfx May 25 '19 at 17:20
  • Please check if you can find 'Audit settings' in your site collection administration page. Also, if there is any 'Audit' related feature in your Farm/ Site collection. – UBK May 27 '19 at 17:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.