How to enable the audit log in SharePoint 2013

To enable the audit log by using Central Administration

·         On the Central Administration home page,

·         In the Application Management section,

·         Click Manage service applications.

·         Select the Secure Store service application.

·         On the ribbon, click Properties.

·         From the Enable Audit section,

·         Click to select the Audit log enabled box.

·         To change the number of days that entries will be purged from the audit log file, specify a number in days in the Days until Purge field.

·         The default value is 30 days.

·         Click OK.

Configure audit settings for a site collection

Please use the following link in which Microsoft has given a very detailed description that references each and every minor point regarding audit settings:

It consists of:

·         Auditing event information

·         Trimming the audit logs (new enhancements in SP2010 and SP2013 as compare to earlier versions)

·         Configure audit log trimming

·         Configure events to audit

http://office.microsoft.com/en-us/sharepoint-help/configure-audit-settings-for-a-site-collection-HA102866204.aspx  

View audit log reports

Following link will help you to understand the following points:

·         Events available for audit log reports

·         Available audit log reports

·         View audit log reports

http://office.microsoft.com/en-us/sharepoint-help/view-audit-log-reports-HA102772739.aspx  

Please let me know in case of any queries/questions so that we can discuss and sort it out quickly.

Thank you

The specified web does not contain a reporting metadata list

When you view Audit log reports on a Microsoft Office SharePoint site, you receive the following error message:

The specified Web does not contain a reporting metadata list.

Guys- one of our clients has opened an incident ticket by mentioning that he is getting the above mentioned error message. If we notice the error message carefully then you will come to know that it’s clarifying something in the direction of site template.

I have started my troubleshooting to find out that if its works properly in Team site template then which are those templates are having these problems. Let me tell you that this troubleshooting took 2-3 hours to test each and every template to find out the correct resolution.

Finally I have successfully resolved this issue and here is my analysis:

This issue may occur if any of the following templates were used to create the default site:

1.   Document Workspace

2.   Wiki

3.   Blog

4.   Records Center

Note: To view Audit log reports, click Audit log reports  on the Site Actions/ Site Settings  menu.

Resolution:

To resolve this issue, run the following STSADM command on the SharePoint server for each affected site collection:

stsadm -o activatefeature -name Reporting -url http://yourssitecollectionurl/ -force

Please check and let me know in case of any further queries/questions, Thank you. Happy SharePoint to all of you :) :)

Unexpected Error when trying to view Audit Log Reports

Guys-from last few months I am trying my best to dig in SharePoint auditing and trying to explore so many things. While exploring, I am trying to create the error message so that it will be easy for me to know the root cause and resolution too. I would like to share my research and thorough findings so that it will be helpful for everybody to minimize the headache that we experienced while troubleshooting the issue.

If you receive an Unexpected Error trying to view the Audit Log Reports on their Site Collection:

·         Access the Site Collection. 

·         Go to Site Actions >Site Settings. 

·         Select Audit Log Reports. 

Error message:

Unexpected Error returned.

Resolution:

Please use the following steps to resolve this issue:

1.   Visit <SiteURL> /_layouts/ManageFeatures.aspx?Scope=Site

Example: https:// spsites.sharepoint.com/sites/amolsp2010 /_layouts/ManageFeatures.aspx?Scope=Site

2.   Deactivate the feature: Reporting. 

3.   Activate the feature Reporting. 

4.   Visit /_layouts/AuditSettings.aspx page and verify the Audit settings. 

5.   After some time, validate the reports are working as expected.

Please let me know in case of any queries/questions regarding the above mentioned information. Thank you.

Reference:

Cannot view audit log reports on site collection: http://sharepointknowledgebase.blogspot.in/2012/07/sharepoint-2010-cannot-view-audit-log.html

How to configure auditing: http://sharepointknowledgebase.blogspot.in/2010/09/sharepoint2010-site-collection-auditing.html

SharePoint 2010-Cannot view audit log reports on site collection

Auditing-Knowing who is taking what action on which content in your site collection can be critical in helping your organization fulfill its requirements, such as meeting regulatory compliance and records management. You save an audit log report as a Microsoft Excel 2010 workbook to a library in the site collection that you specify.

Few months before, I have already written an article on auditing configuration and I really wanted to thank you for your kind responses: http://sharepointknowledgebase.blogspot.in/2010/09/sharepoint2010-site-collection-auditing.html

But now in this article, I am trying to concentrate on one of the incident which has been faced by the local team members.

The issue was: After being enabled the Audit log reports, the link to "Audit log reports” remains unavailable (does not appear) on site collection settings

See, it was very easy to troubleshoot this issue so I request you to follow the below mentioned steps and I am pretty much confident that your issue will be resolved.

Resolution:

I am providing you two options here so you can use anyone as per your flexibility.

Note: in both the options, you must be site collection administrator for the site collection.

Option1:

1.   Open command prompt ( Start-> Run and type cmd ) 

2.   Change to the SharePoint 2010 path (\programfiles\Common files\Microsoft Shared\web server extensions\14\bin) 

3.   Run STSADM.EXE -o activatefeature -name Reporting -url http://sitecollectionurl -force (this may take a while on finishing) 

Option2:

1.   On the site that the Audit log reports are going t be activated

2.   Site Actions

3.   Site settings 

4.   On Site collection administration section

5.   click on Site Collection Features 

6.   Search for the Reporting feature 

7.   Click on Activate button 

Go back to Site Actions->Site Settings and on Site Collection administration section and verify that the link is available now

Please let me know in case of any queries/questions regarding the above mentioned information. I would be more than happy to help you as well as resolves your issues J J

Not able to download audit reports

Auditing is an important feature in SharePoint. Auditing maintains a log of the actions performed on content in a site collection. Administrators can retrieve the entire history of actions — from a particular user or date range.

If you want to learn as how to configure audit settings then please refer the following article: http://office.microsoft.com/en-us/sharepoint-server-help/configure-audit-settings-for-a-site-collection-HA010099726.aspx

Coming back to the main point: One of our clients has raised a ticket with us by mentioning: They are not able to download ‘content viewing’ reports.

What exactly is happening as they are not able to download?

·         Open the SharePoint site on which you are working on

·         Site actions

·         Site settings

·         Site collection administration section

·         Audit log reports

·         Whenever we clicks on ‘content viewing report’ to download

·         It prompts for credentials

·         After entering the correct username and password, it keeps the login prompt as it is and finally ‘you are not authorized to view this page’

What is the reason behind this issue / proper explanation?

Audit settings can be configured at the site collection level only. The logs are maintained in the dbo.AuditData table of the respective content database.

You will find an excellent explanation here:

http://blogs.msdn.com/b/subhajitc/archive/2009/05/20/tip-the-untold-story-of-audit-logs-in-sharepoint.aspx

Resolution:

stsadm -o trimauditlog

   -url <URL name>

   -date <YYYYMMDD>

   -databasename <database name>

   [-databaseserver] <database server name>

Important instructions:

·         If you are providing the site collection URL then there is no need to provide database name as well as database server name

·         Let’s assume that your client wants the audit data in between 21 September 2011 to 25 April 2012 then the date parameter will be 20110921, so the data before this will be deleted or u can call it as trimmed.

Note: This operation is available after the Infrastructure Update for Microsoft Office Servers is installed. This functionality is available only by using Stsadm.

If you have any queries/questions regarding the above mentioned information then please let me know. I would be more than happy to help you as well as resolves your issuesJ J