locked
Sharepoint onpremise audit problem fetching RRS feed

  • Question

  • First it was getting a data for a particular date,ex:01/12/2018 to now.it gets data between 01/12/2018 to 04/12/2018 and stops there


    when I changed to get it from different time period like from 05/12/2019.It still gets only 04/12/2019 and doesn't progress.


    $site=get-spsite $siteurl;

    $siteaudit=$site.Audit;

    $filterQuery = New-Object Microsoft.SharePoint.SPAuditQuery($site);

    $startDate='05/12/2018';

    $filterQuery.SetRangeStart($startDate);

    $siteAuditEntries = $siteAudit.GetEntries($filterQuery);

    Audit script to get data from actual time period given.

    Wednesday, January 16, 2019 6:29 AM

All replies

  • The "$startDate" variable should be a System.DateTime object, not a string.

    --- Rich Matheisen MCSE&I, Exchange Ex-MVP (16 years)

    Wednesday, January 16, 2019 10:53 PM
  • Thanks.

    I gave the actual format of system date and convert it to actual system date but it seems to be repeating the same.


    • Edited by Sai Monesh Thursday, January 17, 2019 2:12 PM
    Thursday, January 17, 2019 2:10 PM
  • Perhaps the query produces more results than the default allows? That's just a guess on my part. I haven't found anything on what the default value for the RowLimit member might be.

    Try setting the query parameters like this:

    $startDate= Get-Date '05/12/2018'
    $endDate = Get-Date
    
    $filterQuery.SetRangeStart($startDate)
    $filterQuery.SetRangeEnd($endDate)
    $filterQuery.RowLimit = [UInt32]::MaxValue
    $siteAuditEntries = $siteAudit.GetEntries($filterQuery)
    


    --- Rich Matheisen MCSE&I, Exchange Ex-MVP (16 years)

    Thursday, January 17, 2019 4:13 PM
  • Thanks,

    But issue seems to be not fixed

    Thursday, January 17, 2019 4:37 PM
  • Set both StartDate and EndDate.  To do a new query create a new query.


    \_(ツ)_/

    Thursday, January 17, 2019 5:16 PM
  • That's what my example does. ;-)

    --- Rich Matheisen MCSE&I, Exchange Ex-MVP (16 years)

    Thursday, January 17, 2019 7:25 PM
  • That's what my example does. ;-)

    --- Rich Matheisen MCSE&I, Exchange Ex-MVP (16 years)

    True but, to change the date range, you need to get a new query object.  The query object is already used and will continue to return the same entries on any subsequent call.

    I have searched for C# examples but there are none that show this and most have other issues that would cause the same outcome here.


    \_(ツ)_/

    Thursday, January 17, 2019 7:50 PM
  • Ahhh . . . sorry. I only meant my example to replace the three  "bolded" lines in the OP's code.

    $site=get-spsite $siteurl;
    $siteaudit=$site.Audit;
    $filterQuery = New-Object Microsoft.SharePoint.SPAuditQuery($site);
    $startDate='05/12/2018';
    $filterQuery.SetRangeStart($startDate);

    $siteAuditEntries = $siteAudit.GetEntries($filterQuery)

    I'm wondering if perhaps auditing is no longer enabled on that SharePoint site.

    Since there's nothing wrong with the Powershell aspect of the problem, it's probably best to re-ask the question in the appropriate SharePoint forum?


    --- Rich Matheisen MCSE&I, Exchange Ex-MVP (16 years)


    Thursday, January 17, 2019 10:17 PM
  • Yes but the issue is NOT with the date it is with changing to a new date.

    This should work:

    $date = [datetime]'03/12/2018', [datetime]'04/12/2018', [datetime]'05/12/2018'
    $site = get-spsite $siteurl
    
    foreach($startDate in $dates){
        $filterQuery = New-Object Microsoft.SharePoint.SPAuditQuery($site.Audit)
        $filterQuery.SetRangeStart($startDate)
        $filterQuery.SetRangeEnd($startDate.AddMonths(1))
        $site.Audit.GetEntries($filterQuery)
    $filterQuery.Dispose() }


    \_(ツ)_/



    • Edited by jrv Thursday, January 17, 2019 10:30 PM
    Thursday, January 17, 2019 10:25 PM
  • Hi,

    Was your issue resolved?

    If you resolved it using our solution, please "mark it as answer" to help other community members find the helpful reply quickly.

    If you resolve it using your own solution, please share your experience and solution here. It will be very beneficial for other community members who have similar questions.

    If no, please reply and tell us the current situation in order to provide further help.

    Best Regards,

    Lee


    Just do it.

    Tuesday, January 22, 2019 6:50 AM