none
SharePoint Audit Report shows only last day report RRS feed

  • Question

  • I have enabled the SharePoint auditing in CA ( with 30 days to purge setting) and even at the site collection level with auto trimming set to 30 days.

    When I am trying to pull a custom report for last week, I get data only for yesterday. In fact if I don't include today's date as the end date, it is throwing me an error "Sorry, something went wrong Report contains no data".

    It is the same case with all the site collection in the farm.

    Could someone please throw me some pointer to trouble shoot the issue? Logs are of not much use.


    ViviSP


    • Edited by ViviSP Wednesday, December 6, 2017 7:06 PM
    Wednesday, December 6, 2017 7:05 PM

Answers

All replies

  • Hi,

    Can you please check the below

    https://www.linkedin.com/pulse/run-audit-reports-o365-sharepoint-online-larry-saytee


    Please remember to click Mark as Answer on the answer if it helps you

    Wednesday, December 6, 2017 10:22 PM
  • Our environment is on premise SP 2013 version. This doesn't apply to me.

    ViviSP

    Thursday, December 7, 2017 4:06 PM
  • Both the UI & PowerShell gives me report of only last one day.

    1. Site settings ->Site Collection settings -> "Audit Log report" -> Content Viewing

    2.  $site = get-spsite - identity http://sitecollection

    $site.audit.getentries()


    ViviSP

    Thursday, December 7, 2017 4:18 PM
  • Hi,

    When did you set up the audit log?

    In my environment, I selected the specify the events to audit, and set the specify the number of days of audit log data to retain is 30 days.

    I can't get the settings before the report.

    If you set the audit log, and get the report immediately, you can't get the report of the previous operation.

    Do you have any third-party application in your environment?

    If yes, you can refer to the following article:

    https://support.microsoft.com/en-in/help/3197429/audit-logging-is-deleted-even-though-audit-data-retention-is-enabled-i

    Best Regards,

    Carl Zhou


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com

    • Proposed as answer by Dean_WangModerator Wednesday, December 20, 2017 9:55 AM
    • Marked as answer by ViviSP Tuesday, December 26, 2017 3:15 PM
    Tuesday, December 12, 2017 9:25 AM
  • Hi,

     

    As you have solved this issue, please mark the reply as answer, it will benefit with others in the community who meet this similar issue in the future.

     

    Best Regards,

    Carl Zhou


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com

    Friday, December 22, 2017 7:08 AM
  • Indeed it was an external application(Varonis) in our case which was causing this issue. After we uninstalled the software everything is working fine.

    Thank you so much for the Microsoft article link.


    ViviSP

    Tuesday, December 26, 2017 3:18 PM