Audit log SecGroupMemberdel missing

Question

we have a powershell script to extract data from the audit log filtering by group membership update (audit Editing users and permissions enable at site level)

while we have a perfect match for the SecGroupMemberAdd it seems like we are missing some SecGroupMemberDel matching the group membership: we cannot see any deletion to a member that result added but is not present anymper in the groups. I should say that the content database was attached a couple of times from a dev farm (differente domain) to a cert farm e production farm (the last ones on the same domain) here an excerpt of the code used

$searchPattern = "*<user>$userId</user>*" 
$eventType = [Microsoft.SharePoint.SPAuditEventType]::SecGroupMemberDel
$eventType2 = [Microsoft.SharePoint.SPAuditEventType]::SecGroupMemberAdd 
$usersList = $site.RootWeb.SiteUserInfoList  

  $query = New-Object Microsoft.SharePoint.SPAuditQuery($site) 
  $query.AddEventRestriction($eventType2) 
  $query.AddEventRestriction($eventType)
  $query.SetRangeStart($startDate) 

does anyone have any hints on what it could be wrong?

thanks

Answer 1

I've finally found the culprit. I was looking for SelectSingleNode("//userid") node, while the missing Delete events only reports SelectSingleNode("//user") (always as id). Including also the user node catch all the events