SharePoint Foundation 2013 - Audit log

Question

Can I read from audit log, how many times item has been clicked? I know that I can do it using Server edition, but what about Foundation?

What I have done: Central Administration, I enabled Secure Store Service / "Audit log enabled"

I also installed https://auditlogsp.codeplex.com/ and I checked logs. However, it seems that Foundation do not save item openings?

I can read same log of course from database: WSS_Content.AuditData

My idea is get all items, which users have clicked most. Can anyone confirm, whether this possible?

I also tried using custom code, but some reason it return 0:

class MostViewedItems
{

public DataTable table = new DataTable();

public SPSite siteUrl;

public DataTable GetRecentlyViewedReports()
{
    try
    {
        table.Columns.Add("ItemId", typeof(Guid));
        table.Columns.Add("ItemName", typeof(string));
        table.Columns.Add("ItemCount", typeof(int));

        siteUrl = SPContext.Current.Site;
        string url = siteUrl.Url;
        SPSecurity.RunWithElevatedPrivileges(delegate()
        {
            using (SPSite site = new SPSite(url))
            {
                foreach (SPWeb web in site.RootWeb.GetSubwebsForCurrentUser())
                {
                    getRecentAuditlog(web, "Documents");
                    web.Dispose();
                }
            }
        });
        // TODO
    }
}

public void getRecentAuditlog(SPWeb web, string lst)
    {
        try
        {
            SPList list = web.Lists.TryGetList(lst);
            if (list != null)
            {
                SPAuditQuery spQuery = new SPAuditQuery(web.Site);
                spQuery.RestrictToList(list);
                spQuery.RestrictToUser(SPContext.Current.Web.CurrentUser.ID);
                spQuery.AddEventRestriction(SPAuditEventType.View);
                spQuery.SetRangeStart(DateTime.Today.AddDays(-30));
                spQuery.SetRangeEnd(DateTime.Today.AddDays(1));
                SPAuditEntryCollection auditCol = web.Site.Audit.GetEntries(spQuery);

                // auditCol returns 0
}

Answer 1

You have enabled auditing for the Secure Store Service and that only enables auditing for operations on the Secure Store Service Application.

You have to enable auditing for the site collection where your list resides.

As per the following comparison chart auditing is not included in SharePoint Foundation 2013, at least not using the UI.

SP 2013 version comparison chart

It can be enabled with PowerShell though:

$site = Get-SPSite http://site_URL 
$site.Audit.AuditFlags = [Microsoft.SharePoint.SPAuditMaskType]::Update #or any other mask type
$site.Audit.Update() 

Source

For SP 2013 Standard or Enterprise:

Go to Site Actions –> Site Settings –> Site Collection Administration –> Site Collection audit settings

Answer 2

Following the instructions above, I was able to turn on auditing for one of my sites, but queries can only be run through PowerShell, on Foundation there is no GUI audit option (as mentioned above as well). Also, in my case the PowerShell script/commands required the farm account to run it, I kept getting an "Access denied" error when I was running it from my account (a local admin on the SharePoint box). I used:

$site = Get-SPSite http://site_URL
$site.Audit.AuditFlags = [Microsoft.SharePoint.SPAuditMaskType]::Update -bxor [Microsoft.SharePoint.SPAuditMaskType]::Delete
$site.Audit.Update() 

Then I used this command to pull site updates or deletes: $site.Audit.GetEntries()