Auditing-Knowing who is taking what action on which content in your site collection can be critical in helping your organization fulfill its requirements, such as meeting regulatory compliance and records management. You save an audit log report as a Microsoft Excel 2010 workbook to a library in the site collection that you specify.
Few months before, I have already written an article on auditing configuration and I really wanted to thank you for your kind responses: http://sharepointknowledgebase.blogspot.in/2010/09/sharepoint2010-site-collection-auditing.html
But now in this article, I am trying to concentrate on one of the incident which has been faced by the local team members.
The issue was: After being enabled the Audit log reports, the link to "Audit log reports” remains unavailable (does not appear) on site collection settings
See, it was very easy to troubleshoot this issue so I request you to follow the below mentioned steps and I am pretty much confident that your issue will be resolved.
Resolution:
I am providing you two options here so you can use anyone as per your flexibility.
Note: in both the options, you must be site collection administrator for the site collection.
Option1:
1. Open command prompt ( Start-> Run and type cmd )
2. Change to the SharePoint 2010 path (\programfiles\Common files\Microsoft Shared\web server extensions\14\bin)
3. Run STSADM.EXE -o activatefeature -name Reporting -url http://sitecollectionurl -force (this may take a while on finishing)
Option2:
1. On the site that the Audit log reports are going t be activated
2. Site Actions
3. Site settings
4. On Site collection administration section
5. click on Site Collection Features
6. Search for the Reporting feature
7. Click on Activate button
Go back to Site Actions->Site Settings and on Site Collection administration section and verify that the link is available now
Please let me know in case of any queries/questions regarding the above mentioned information. I would be more than happy to help you as well as resolves your issues J J
Option 2 worked for me. I don't think I'd have worked this out without this blog. Thanks
ReplyDeleteI have not enabled audit reporting in my site collection, if I enable now would it be possible for me to see the logs like who has uploaded / deleted the content previously? thanks in advance
ReplyDeleteNo, it should be enabled before.
ReplyDeleteBut you can enable now so it will be useful from future perspective.
Thanks a lot for the reply Amol :) I would like to know how to interpret / analyse the excel we obtained from the results, the reason why I am asking this we have done so much of activities in a site collection but if open a audit log only few activities are recorded for example number of views for _catalogs/masterpage which is nothing but homepage visits right? PS: I have tried all the option under the audit log link in site collection administrations and checked the sheet 2 that is report data in the excel sheet. If you help me that would be gr8!
ReplyDeletemake sure what kind of options you have checked in the audit settings- that's the vital step.
ReplyDeleteas you can able to see the view entries, try to delete any thing example list/library and then check the auditing entries, it has to reflect there without any issues. also the excel sheet contains multiple tabs within that, make sure you are checking all the ones
Please check and let me know in case of any queries, thank you
Amol thanks again for the fast reply! you are so kind enough :) like I told you there are so much of activities going on in the site collection that includes deletion of contents even deletion of some sub sites I have tried a different combination like only deletion in audit settings and choosing the deletion event in audit log it showed me "No data error"? this is the part am confused using the feature
ReplyDeleteYou can now use standard Excel features to narrow the reports to the information you want. Some ways in which you can analyze and view the log data include:
ReplyDelete-Filtering the audit log report for a specific site.
-Filtering the audit log report for a particular date range.
-Sorting the audit log report.
-Determining who has updated content.
-Determining which content has been deleted but not restored.
-Viewing the changes to permissions on an item.
Run a custom report-- You can specify the filters for a custom report, such as limiting the report to a specific set of events, to items in a particular list, to a particular date range, or to events performed by particular users.
The following events are available for audit log reports to help you determine who is taking what actions with the content of a site collection:
Opened and downloaded documents, viewed items in lists, or viewed item properties (This event is not available for SharePoint Online sites)
Edited items
Checked out and checked in items
Items that have been moved and copied to other location in the site collection
Deleted and restored items
Changes to content types and columns
Search queries
Changes to user accounts and permissions
Changed audit settings and deleted audit log events
Workflow events
Custom events
Hi Amol,
ReplyDeleteI tried both the options, but I couldn’t find the solution.
Option 1:
When I tried option 1 using command prompt, I faced an error as
“Failed to find the XML file at location ‘14\Template\Features\Reporting\feature.xml”
Option 2:
Reporting feature is not available in site collection features.
Please help me out from this issue.
Did you do an in place upgrade? Did the 2007 farm have any custom solutions deployed?
DeleteIf you install a feature in your sharepoint farm and after that the feature folder or the feature manifest file accidently gets deleted from your Web Front End servers file system, you will get the error "Failed to find the XML file at location '14\Template\Features\Feature_Name\feature.xml"
How many FE's you have?
check the other front end in reference to the same location? if the feature is the there then copy-paste the same on other front end.
Trying to see who deleted users access on site so running audit log report from site collection by selecting deltion category.
ReplyDeleteGiven path as documents
Throwing error as it cant contain any data.
Access was lost 3 days back
Restored also
wanna chk how it was done
Any inputs?
I am new to SP 2010
Rakesh
Make sure it was enabled/checked before the data got deleted.
Deletein the audit settings, check the appropriate boxes that you required and try deleting anything. this will definitely gets captured inside the deletion logs.
let me know in case of any queries, Thank you.
Hello Amol,
ReplyDeleteThanks for the explanation on where to find the reports.
This part is sadly missing on most of the articles explaining how to turn on the auditing.
Kind regards,
Philippe
Thank you Philippe 4 your kind words.
DeletePlease let me know in case of any queries and issues.. I will try my best ti resolve it as soon as possible!!
Thank you very much. I activated Report feature and I now I can see the link to "Audit log reports”
ReplyDeleteHi Amol,
ReplyDeleteCan a person who has only site admin and not site collection admin can retrieve Audit Logs using SOM AuditQuery class?
Thanks,
Harika
No, site admin cannot retrieve, he should be a site collection administrator to retrieve the audit logs.
DeleteLet me know in case of any further queries, thank you.
Hi Amol,
ReplyDeleteFacing an issue here in Audit Reports. The issue is when one site collection admin tries to run the Security Settings Audit report the report is getting generated successfully; however if another site collection admin treis to run the same report he gets an error. When checked in to the log files the error was "System.Runtime.InteropServices.COMException: Error HRESULT E_FAIL has been returned from a call to a COM component. at System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal"
Any ideas??
Thanks,
Sumukh
I hope that user don't have multiple domain ID's, Please check this and confirm. additionally, just to isolate the thought, did you check this in multiple browsers? I would suggest to check once. let me know the results.
DeleteThanks for this Amol. However, the user do not have multiple Domain Ids. Also, we checked on a same browser of a single machine; it works for a user ID & fails for another.
ReplyDeleteOk, here is the plan-
Deletefor whom its not working, let him logged in to the sharepoint site
Open the SharePoint site
IE -> Tools -> compatibility settings
Check "Dispaly all websites in compatibility view".
add your sharepoint site on the top ("add this website" section) if its empty (by default it takes but sometimes its not)
refresh it and check the results
No Luck...!!!
DeleteOK, lets try to test one more use case-
DeleteOpen your site -> Site actions ->site settings -> people and groups -> click on any group -> that group will be highlighted in the right hand side -> On the top in the explorer ->You will see the group ID (something like group id=56) -> change this number to 0 -> Hit Enter -> this will open all users which are a part of of your site -> now select the user who is having the problem -> actions -> Delete user from site collection -> This will remove him from the complete site.
-Go to the site collection admin section -> add that user and check again.
Let me know the results. Thanks.
Hello Amol,
DeleteThanks for this. But after executing the test case still getting the same error.
Thanks,
Sumukh
Is this not working only on this site? did you try on any other site collection?
DeleteThank you SOOO much for your help! I have been searching for a while trying to find a solution to this and being able to view audit logs and found nothing until this site. Thanks for posting this most helpful information.
ReplyDeleteAwesome :) Thanks Benton for the confirmation!
DeleteThe custom report for user permission changes only shows the groupid instead of the group name, we have 780+ groups is there an easy way to get the name instead of the id number? Thank you.
ReplyDeleteGreat article, I found proficient application from http://www.lepide.com/sharepoint-audit/ which enables to to track site collection users/administrative activity and view of documents, document libraries, users, permissions, accesses, site, folders and generate sophisticated report on demand. It gives the complete visibility of your Sharepoint Server (Who has done and What, When, Where, changes on the server and at which SharePoint site ).
ReplyDelete