none
Automatic Audit log trimming. RRS feed

  • Question

  • Hi,

    I have a few questions about the Audit logging í SharePoint 2013.  I am using the Audit logging functionality to monitor user actions on documents in a Record Center.

    It is very important that I can give a report on user actions on the documents when superiors ask for such a report.

    I have not been able to produce the behavior I would expect from this functionality.

    I have created a document library called ‚AuditReports‘ to store audit reports that I create manually, and those that I thought would be created automatically during automatic trimming of the log.

    In my test environment In the ‚Site collection audit settings‘  of the Record Center I have set the auditing settings to trim the audit log automatically.  I have also specified a location to store audit reports before trimming the audit log.

    Here are my questions:

    Before SharePoint automatically trims the log, a report should be created and stored in the specified library automatically, right?  I have not been able to produce that behaviour...

    Also when I run the ‚Audit log trimming‘ timerjob manually, no report is created (automatically).  If I thereafter create a report manually, the report includes actions taken before the trimming takes place.  Is that expected behaviour?

    Maybe somebody has experience using this feature and can give some advice on how it works in real world situations?

    B. regards,

    Atli

    Monday, May 19, 2014 1:52 PM

Answers

All replies

  • Hi Atli,

    To prevent the audit log from filling the hard drive and potentially degrading the performance of the site collection, we recommended that you enable audit log trimming for site collections with extensive auditing. In the Configure Audit Settings, Automatically trim the audit log does not mean automatically generates the reports. To manage the size of the audit log you can configure it to automatically trim and optionally archive the current audit log data in a document library before the data is trimmed. The schedule for audit log trimming is configured by your server administrator in Central Administration. The default is the end of the month.

    After enabling Auditing

    Please check the thread below for automatically generating audit report:

    http://social.technet.microsoft.com/Forums/sharepoint/en-US/2003c93c-c214-4414-825c-9c4a8116b8f3/sharepoint-2010-auto-generate-audit-report-archive?forum=sharepointadminprevious 

    Here are the references for configuring audit settings:

    http://office.microsoft.com/en-us/sharepoint-server-help/configure-audit-settings-for-a-site-collection-HA102031737.aspx

    http://anthony-verschraegen.blogspot.com/2013/04/sharepoint-2013-configuring-audit.html

    Regards,


    Rebecca Tu
    TechNet Community Support

    • Marked as answer by Atli Þ Tuesday, May 20, 2014 8:42 AM
    Tuesday, May 20, 2014 8:08 AM
  • Hi Rebecca,

    Thank you very much for your answer.  When you say 'To manage the size of the audit log you can configure it to automatically trim and optionally archive the current audit log data in a document library before the data is trimmed'  You are talking about the manual action of creating an Audit Report, through the 'Audit log reports' link in site collection administration, and storing it in a document library, am I right?

    I will definitely look into the option of creating a custom timer job to do this automatically using the SPAuditQuery object.  Thank you very much for your help.

    Regards,

    Atli

    Tuesday, May 20, 2014 8:42 AM
  • Hi Rebecca/Atli,

    Our MOSS environment is primarily used for Enterprise - BI/Dashboard reporting.

    The users wants to do data mining on the usage data (AuditData table) by tranforming the data to Fact (STAR schema). So storing the usage data (AuditData table) in document library is not much of use to us.

    So we have created a SQL server job to upload the data to AuditDataArchive table:

    insert into [WSS].[dbo].[AuditDataArchive]
    SELECT *
      FROM [WSS].[dbo].[AuditData]
    where [Occurred] <= DATEADD(d,-6,getdate())

    The above job runs 15 min before the Audit log trimming job setup to run weekly with 7 days retention.

    Is there any other better approach?

    Thanks,

    Vikas.

    Tuesday, September 23, 2014 7:04 PM
  • That is unsupported. You instead need to use the SPAudit API to access the audit log and export that data to a custom database that can be mined for information.

    Trevor Seward

    Follow or contact me at...
      

    This post is my own opinion and does not necessarily reflect the opinion or view of Microsoft, its employees, or other MVPs.

    Tuesday, September 23, 2014 8:06 PM
    Moderator