Hot answers tagged

4

It looks like it's not possible without manual filtering. All the entries are stored in the site collection database in the table dbo.AuditData so GetEntries is just a method to get the data from the table. Let's look at the table structure: [dbo].[AuditData]( [SiteId] [uniqueidentifier] NOT NULL, [ItemId] [uniqueidentifier] NOT NULL, [ItemType]...


4

Opening a web does not cause an entry to be created in the SharePoint audit log. Assuming you have "view" auditing turned on at the web or site collection level that will log views (opens) of documents, list items, and item properties. Extend your code above to open a file...i.e. SPFile.OpenBinary. That will cause audit entries to be created.


3

Add-PSSnapin Microsoft.SharePoint.PowerShell -ErrorAction SilentlyContinue; $spSite=Get-SPSite -Identity "http://sp/sites/dev" $spwWeb=$spSite.OpenWeb() $spAuditQuery=New-Object Microsoft.SharePoint.SPAuditQuery($spSite) $Today = [DateTime]::Today $DateLimit = $Today.AddDays(-7) $spAuditQuery.SetRangeStart($DateLimit) $...


3

your doing nothing to the web object? did you mean that you want to write to the web audit log event? using System; using Microsoft.SharePoint; namespace Audit.Tests { internal class Program { private static void Main() { const string siteURL = "http://somesite"; const int n = 50000; const int k =...


2

Audit logs should be maintained as per capacity planning you have in place (Steve Goldberg gives an example of how to calculate space taken https://www.nothingbutsharepoint.com/sites/itpro/Pages/Best-Practices-for-Auditing-in-SharePoint.aspx). Only activate it where/when needed and configure trimming as soon (i wouldn't go for an hour as you could have ...


2

Its explained indepth here with images how to use SPAudit ;) http://www.codeproject.com/Articles/431342/Auditing-A-Built-in-Feature-of-SharePoint SPAudit and its members http://msdn.microsoft.com/en-us/library/microsoft.sharepoint.spaudit.aspx members http://msdn.microsoft.com/en-us/library/microsoft.sharepoint.spaudit_members.aspx This is taken from ...


2

You can check the AuditData table with a query in the content database. Then you will be sure that your code is the problem. If you are sure that your code is the problem then check the following: Users that are assigned permissions in SharePoint only through AD groups they are not added in SharePoint users information list in the site. If you check in ...


2

The issue is related to this line dRow["NewColumn"] = entry.MachineName; where the entry.MachineName returns as NULL. (Debugged on my side) Unfortunately, By Design the returned values of the MachineName and MachineIP are always NULL for Privacy concerns. Besides the above issue, There is a bit syntax issue related to this line DataRow dRow = dtAudit....


2

Adjust as needed. $webapp = Get-SPWebApplication http://webAppUrl $auditmask = [Microsoft.SharePoint.SPAuditMaskType]::View -bxor [Microsoft.SharePoint.SPAuditMaskType]::Update ` -bxor [Microsoft.SharePoint.SPAuditMaskType]::Delete -bxor [Microsoft.SharePoint.SPAuditMaskType]::Search $webapp.sites | % { $_.TrimAuditLog = $true $_.Audit.AuditFlags = $...


1

You need to go into the site collection settings and configure what events you want to audit.


1

There is no CSOM/JSOM to generate SharePoint site collection audit logs; the class you referenced is for SharePoint on-prem only. In general, you shouldn't be using site collection audit logging in SharePoint Online, rather use the Office 365 Security and Compliance center audit logs. Take a look into the Office 365 Management Activity API reference for a ...


1

SPAudit doesn't contain method to delete specific SPAuditEntries, nor does SPAuditEntry contain method to delete individual entry. Also using common sense being able to remove specific Audit entries would not make much sense as one could easily wipe out traces of specific actions.


1

Try this: using (SPSite mysiteCollection = new SPSite(SPContext.Current.Site.ID)) { using (SPWeb oWeb = mysiteCollection.OpenWeb()) { SPAuditQuery query = new SPAuditQuery(mysiteCollection); query.SetRangeStart(DateTime.Now.AddDays(-1)); query.SetRangeEnd(DateTime.Now); ...


1

You can try the following code SPAudit audit = siteCollection.Audit; audit.AuditFlags = SPAuditMaskType.SecurityChange | SPAuditMaskType.SchemaChange; audit.Update(); For more information, please refer to the following link: https://www.codeproject.com/articles/431342/auditing-a-built-in-feature-of-sharepoint https://gallery.technet.microsoft.com/...


1

There is no API to modify an existing event entry. The only way I know is with a SQL script directly modify the records in AuditData table in the content database. I'm not sure will that action leave your DB in 'unsupported mode' or not. You better check that with MSFT first.


1

I found a workaround that works in my case, but is resource heavy. What I do is this: Get all audit events over the last 30 days for the site collection. Using depth-first find all entries where SPAuditEntry.DocLocation starts with the server relative url of that web (remove leading /). Remove these entries and place them in separate list for processing. ...


1

To store settings about actions and events that are audited SharePoint uses SPAuditMaskType enumeration. public enum SPAuditMaskType { All = -1, None = 0, CheckOut = 1, CheckIn = 2, View = 4, Delete = 8, Update = 16, ProfileChange = 32, ChildDelete = 64, SchemaChange = 128, SecurityChange = 256, Undelete = 512, ...


1

I'll opine that yes it is normal. Here is why: The concept of files and folders exists purely for our convenience. There really aren't a series of folders on the filesys, rather, it's all crammed in the database. Now what's going on with the folder is more closely related to what you need to do to pull a file out of a .zip archive. First you got to get the ....


1

to be honest I wouldnt know, but im taking a shot here.... I would gess that its logging not just the parent but also the child/file that you open. That said you need to find out what kind of audit logging you have enabled on your site. Also audit log OOB is kinda broken and doesnt work properly as you have found out. I had a quick lookup and found a great ...


Only top voted, non community-wiki answers of a minimum length are eligible