I only see entries with type "Update". Should other types of events also be recorded? Is this normal SharePoint behavior?

I use this PowerShell to check what kind of events I have on the attachments:

$s=Get-SPSite https://sharepoint/  
$q=New-Object Microsoft.SharePoint.SPAuditQuery($s)
$s.Audit.GetEntries($q) |? DocLocation -Like '*Attachments*'

1 Answer 1


Per my test, I could reproduce your issue, it seems like audit log only record view and update event for attachments.

I try to delete the attachments and upload again, the report only log the new file with update.

In addition, following events are available for normal documents and items:

  1. Opened and downloaded documents, viewed items in lists, or viewed item properties (This event is not available for SharePoint Online sites)

  2. Edited items

  3. Checked out and checked in items

  4. Items that have been moved and copied to other location in the site collection

  5. Deleted and restored items

  6. Changes to content types and columns

  7. Search queries

  8. Changes to user accounts and permissions

  9. Changed audit settings and deleted audit log events

  10. Workflow events

  11. Custom events

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.