Audit Log Reports

I had a forced introduction to Auditing Reports, a subject which isn't very well convered pretty much anywhere.

What is it?  A history of all actions taken on a site collection since the creation of the site collection. 
Where is it stored?  Dbo.auditData
What does it look like?  Heres a row from the table

Site Id Item Id Item Type User Id Machine Name Machine IP Document Location Location Type Occurred (GMT) Event Custom Event Name Event Source Source Name Event Data
ed91340f-e335-45d2-82f3-c6521eb23fc0 59af845e-b604-436e-9c08-0a948a27d996 Document NT AUTHORITYlocal service _catalogs/masterpage/Editing Menu/CustomSiteAction.xml URL 2008-01-02T00:44:43 View SharePoint

<Version>
<Major>0</Major>
<Minor>1</Minor>
</Version>

How do you get to it?  http://server/sitecollection/_layouts/Reporting.aspx?Category=Auditing or alternatively Site Settings > Site Collection Administratoin > Audit Log Reports

First issue you might come across starts here.  The feature has to be enabled on your site, fairly easy to do :

stsadm -o activatefeature -name Reporting -url http://server/sitecollection/ -force

That will enable the feature on your site collection, allowing you to view the URL listed above.

The usage of this page is pretty straight forward, you can view all of the audit data for your site, or if need be create a custom report.  If you do create a custom report, make sure you do not click "OK" to return to home, you'll miss your report and some of them can take a little while (minutes) to generate, especially if your site has 6 months or more of auditing data.  Even on a site with light usage your auditData table can get big very quickly, for instance one of ours hit 47,000 rows and a content viewing report was over 50 meg being generated.  This was causing timeouts from the site.

The reports will look like XML unless you have Excel installed in which case you will get a look like this :

Site Id (All)
Count of Occurred Event  
Document Location View Grand Total
_catalogs/masterpage/Editing Menu/CustomSiteAction.xml 1 1
Site Images 16 16
Style Library/Custom.css 45 45
Style Library/XSL Style Sheets/Header.xsl 3 3
Reporting Templates/audit1.xml 7 7
Site Images/kc.png 4 4
Style Library/FinalHeader.jpg 33 33
Site Images/initiatives.png 4 4
Style Library/FinalHeader.png 33 33
_catalogs/masterpage/default.master 6 6
Pages/Default.aspx 9 9
Style Library 112 112
Style Library/XSL Style Sheets 9 9
_catalogs/masterpage/Editing Menu 1 1
_catalogs/masterpage 6 6
Style Library/XSL Style Sheets/ContentQueryMain.xsl 3 3
Pages 9 9
Style Library/XSL Style Sheets/ItemStyle.xsl 3 3
administration/default.aspx 6 6
Site Images/contact_list.png 4 4
Site Images/newsletter.png 4 4
Reporting Templates 7 7
Grand Total 325 325

I should also add that if you wish to configure the audit logging you can cut it down a bit.  The "Configure Audit Settings" option under "Site Settings" will allow you to determine which events are audited, its high level but enough to significantly reduce the size of the table if needed.

Advertisements