Are audit logs in SharePoint Server collected for events on attachments?

Question

I only see entries with type "Update". Should other types of events also be recorded? Is this normal SharePoint behavior?

I use this PowerShell to check what kind of events I have on the attachments:

$s=Get-SPSite https://sharepoint/  
$q=New-Object Microsoft.SharePoint.SPAuditQuery($s)
$s.Audit.GetEntries($q) |? DocLocation -Like '*Attachments*'

Answer 1

Per my test, I could reproduce your issue, it seems like audit log only record view and update event for attachments.

I try to delete the attachments and upload again, the report only log the new file with update.

In addition, following events are available for normal documents and items:

1. Opened and downloaded documents, viewed items in lists, or viewed item properties (This event is not available for SharePoint Online sites)

2. Edited items

3. Checked out and checked in items

4. Items that have been moved and copied to other location in the site collection

5. Deleted and restored items

6. Changes to content types and columns

7. Search queries

8. Changes to user accounts and permissions

9. Changed audit settings and deleted audit log events

10. Workflow events

11. Custom events