How to Tell If Documents Have Been Viewed when Auditing isn't Enabled? RRS feed

  • Question

  • Is there anyway to tell if someone viewed a document within MOSS 2007 when auditing wasn't turned on?  A report, etc. would be helpful.

    Thank You.

    • Edited by Mike Walsh FIN Wednesday, June 22, 2011 6:08 AM Jumpy title made into single question
    Tuesday, June 21, 2011 9:19 PM


All replies

  • Hi,

    It will be difficult to get audit report if you have not turned on auditing feature.

    Maybe you can collection some audit information from your IIS logs using third party IIS log analyzer.

    To get IIS logs, please refer to: http://portal.smartertools.com/KB/a154/where-are-my-iis-log-files-stored.aspx

    Seven Ma

    TechNet Subscriber Support in forum

    If you have any feedback on our support, please contact tngfb@microsoft.com  

    Wednesday, June 22, 2011 7:41 AM
  • Seven Ma,


       Thank you for getting back to me.  I just finished looking over the IIS logs and there isn't any information in there that is going to be of use . . . unfortunately.  I can see where some users deleted files from the system and recycle bin, but not if they opened any of them.  I also noticed that the IIS logs all seem to stop around 8pm, do you know the reason for that?



    Wednesday, June 22, 2011 2:32 PM
  • Seven Ma,


       Your suggestion worked!  After obtaining my IIS log files, I was able to filter out the data by using the following statements (please fill in your information as appropriate):

    SharePointServerIPAddress GET /SiteNameThatYouAreInterestedIn/

    I then filtered the data that I received from running the first query, with the following query in order to limit the amount of data that I had to analyze and make it more relevant (this was so that I could find out exactly who looked at what):



    And then it was just a painstaking couple hours of analyzing the data that was presented after running the second query to filter the data.  

    It wasn't anything that I would want to have to do again, but in a pinch this solution worked.


    Thank You,


    Wednesday, June 22, 2011 8:07 PM