In my current work location we have a MOSS 2007 intranet environment with more than 10 site collections, but in one of the site collections few sub-sites were deleted on the same day. We have analysed the IIS logs to find out who deleted the site but there were no deleteweb.aspx or webdeleted.aspx entries for those sites.

In addition to that Audit logging was not enabled in the SP application when sub sites were deleted and few users on one of the sub-sites used SP designer where the entries for author.dll could be seen in the IIS logs, but none of the users claimed the site deletion.

We are trying every possible way to figure out how sub sites were deleted, but no luck. Since the sub sites are on production server with business critical data in it, we cant afford the same thing happening again.

So could you suggest me any possible way to find how the sites were deleted?

  • Did you analyze the logs in the 12-hive? – Eric Herlitz Jun 19 '12 at 17:30
  • Yes I did analyze the ULS logs. Site deletion entries are not recorded in those logs. – Yashwanth Mannem Jun 19 '12 at 18:55

Try a log viewer like http://splogviewer.codeplex.com/ or http://features.codeplex.com/

If not found there the IIS-logs is your best bet.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy