Audit Log Reports
January 2, 2008 Leave a comment
I had a forced introduction to Auditing Reports, a subject which isn't very well convered pretty much anywhere.
What is it? A history of all actions taken on a site collection since the creation of the site collection.
Where is it stored? Dbo.auditData
What does it look like? Heres a row from the table
Site Id | Item Id | Item Type | User Id | Machine Name | Machine IP | Document Location | Location Type | Occurred (GMT) | Event | Custom Event Name | Event Source | Source Name | Event Data |
ed91340f-e335-45d2-82f3-c6521eb23fc0 | 59af845e-b604-436e-9c08-0a948a27d996 | Document | NT AUTHORITYlocal service | _catalogs/masterpage/Editing Menu/CustomSiteAction.xml | URL | 2008-01-02T00:44:43 | View | SharePoint |
<Version> |
How do you get to it? http://server/sitecollection/_layouts/Reporting.aspx?Category=Auditing or alternatively Site Settings > Site Collection Administratoin > Audit Log Reports
First issue you might come across starts here. The feature has to be enabled on your site, fairly easy to do :
stsadm -o activatefeature -name Reporting -url http://server/sitecollection/ -force
That will enable the feature on your site collection, allowing you to view the URL listed above.
The usage of this page is pretty straight forward, you can view all of the audit data for your site, or if need be create a custom report. If you do create a custom report, make sure you do not click "OK" to return to home, you'll miss your report and some of them can take a little while (minutes) to generate, especially if your site has 6 months or more of auditing data. Even on a site with light usage your auditData table can get big very quickly, for instance one of ours hit 47,000 rows and a content viewing report was over 50 meg being generated. This was causing timeouts from the site.
The reports will look like XML unless you have Excel installed in which case you will get a look like this :
Site Id | (All) | |
Count of Occurred | Event | |
Document Location | View | Grand Total |
_catalogs/masterpage/Editing Menu/CustomSiteAction.xml | 1 | 1 |
Site Images | 16 | 16 |
Style Library/Custom.css | 45 | 45 |
Style Library/XSL Style Sheets/Header.xsl | 3 | 3 |
Reporting Templates/audit1.xml | 7 | 7 |
Site Images/kc.png | 4 | 4 |
Style Library/FinalHeader.jpg | 33 | 33 |
Site Images/initiatives.png | 4 | 4 |
Style Library/FinalHeader.png | 33 | 33 |
_catalogs/masterpage/default.master | 6 | 6 |
Pages/Default.aspx | 9 | 9 |
Style Library | 112 | 112 |
Style Library/XSL Style Sheets | 9 | 9 |
_catalogs/masterpage/Editing Menu | 1 | 1 |
_catalogs/masterpage | 6 | 6 |
Style Library/XSL Style Sheets/ContentQueryMain.xsl | 3 | 3 |
Pages | 9 | 9 |
Style Library/XSL Style Sheets/ItemStyle.xsl | 3 | 3 |
administration/default.aspx | 6 | 6 |
Site Images/contact_list.png | 4 | 4 |
Site Images/newsletter.png | 4 | 4 |
Reporting Templates | 7 | 7 |
Grand Total | 325 | 325 |
I should also add that if you wish to configure the audit logging you can cut it down a bit. The "Configure Audit Settings" option under "Site Settings" will allow you to determine which events are audited, its high level but enough to significantly reduce the size of the table if needed.