I've run into following issue when i try to execute Audit Custom Report on one of the site collections.

10/19/2012 09:30:02.03  w3wp.exe (0x211C)   0x12D8  SharePoint Foundation   Runtime tkau    Unexpected  System.Runtime.InteropServices.COMException: Error HRESULT E_FAIL has been returned from a call to a COM component.    at System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32 errorCode, IntPtr errorInfo)     at Microsoft.Office.Server.OpenXml.Internal.ByteStream.Write(Byte[] rgb, Int32 offset, Int32 cb)     at System.IO.BufferedStream.Write(Byte[] array, Int32 offset, Int32 count)     at System.IO.StreamWriter.Flush(Boolean flushStream, Boolean flushEncoder)     at System.IO.StreamWriter.Write(String value)     at System.Xml.XmlTextEncoder.WriteEntityRefImpl(String name)     at System.Xml.XmlTextEncoder.Write(String text)     at System.Xml.XmlTextWriter.WriteString(String text)     at System.Xml.XmlWriter.WriteElementString(String localName, String ns, String value)     at Microsoft.Office.Server.OpenXml.Internal.Excel.ExcelStringTable.GetStringAtom(String str, Boolean bIsUniqueString)     at Microsoft.Office.RecordsManagement.Reporting.ExcelOpenXmlReportGenerator.<>c__DisplayClass16.<WriteCellStringValue>b__15(XmlTextWriter _xmlwrtr)     at Microsoft.Office.RecordsManagement.Reporting.ExcelOpenXmlReportGenerator.WriteWorksheetCell(XmlTextWriter xmlwrtr, String strCellId, WriteXmlData delWrtCellAttribs, WriteXmlData delWrtCellValue)     at Microsoft.Office.RecordsManagement.Reporting.AuditReportGenerator.<>c__DisplayClass21.<OnInjectDataRow>b__1e(XmlTextWriter xmlwrtr)     at Microsoft.Office.RecordsManagement.Reporting.ExcelOpenXmlReportGenerator.WriteWorksheetRow(XmlTextWriter xmlwrtr, String strRowNumber, String strNumColumns, WriteXmlData delWrtCells)     at Microsoft.Office.RecordsManagement.Reporting.AuditReportGenerator.OnInjectDataRow(String[] rgstrColData)     at Microsoft.Office.RecordsManagement.Reporting.ReportData.GenerateNextReport()     at Microsoft.Office.RecordsManagement.Reporting.ReportBase.AggregateReports(Hashtable query, SPFolder folder, ReportNameGenerator reportNameGenerator)     at Microsoft.Office.RecordsManagement.Reporting.ApplicationPages.CustomizeReport.OKBtn_Click(Object sender, EventArgs e)     at System.Web.UI.WebControls.Button.OnClick(EventArgs e)     at System.Web.UI.WebControls.Button.RaisePostBackEvent(String eventArgument)     at System.Web.UI.Page.RaisePostBackEvent(IPostBackEventHandler sourceControl, String eventArgument)     at System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)   367f6a05-977b-41cb-8624-55b8fc307034    

There is nothing more in the logs under this correlation id except OfficePackageLibrary initializing and OfficePackageLibrary initialized message 5 seconds before. Exception is thrown right after running the reprot.

I don't have direct access to environment, where problem occurs,that's why i would like you to ask, where should i look for the reason to this error.

The only thing that I found similar to this error was



SharePoint is two server farm (db+webfront), i expect that there is a lot of entries in the audit logs.

1 Answer 1


Have to tried to audit sharepoint with LOGbinder instead? It will allow you to send SharePoint audit events to the Windows Security Log or application log or to a syslog server where your SIEM can then run those custom reports you're looking for.

  • I'm still waiting for feedback from customers, but i don't think i will be able to use this tool on their prod. environment. Oct 30, 2012 at 9:59
  • Please note that Astroturfing and self promotion is not welcome on Stack Exchange. See the FAQ [sharepoint.stackexchange.com/faq] for more details
    – Hugh Wood
    Nov 21, 2012 at 11:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.