Auditing settings for SharePoint Configuration site collections

Configure audit settings for a site collection

You can use the auditing features of Microsoft SharePoint Server 2010 to track which users have performed actions on site collection sites, content types, lists, libraries, list items, and library files. Knowing who is doing what with what information is critical to many business requirements, such as adherence to regulations and management records.

As an administrator of a site collection, you can retrieve the history of actions performed by a specific user, or you can retrieve the history of actions performed within a specific date range. For example, you can determine which users have edited a particular document, and when they edited the document.

The following is the Configure Audit Settings page. You can manage the size of the audit log in the audit log trimming section and specify which events to audit in the documents and items and lists, libraries, and sites sections.

All events that you select to audit are captured in an audit report that is based on Microsoft Excel 2010 and can be accessed on the audit Reports page. You can also create a custom report that includes events within a specified date range, events within a specific area of a site collection, or individual user events. Although events cannot be modified once they are logged in the log, site collection administrators can remove items from the audit log and configure automatic trimming of audit log data.

Audit event Information

The audit log captures the following information about events that have been selected for auditing.

• The site that raised the event
• Project ID, type, name, and location

• User ID associated with the event
• Event type, date, time, and source
• Actions performed on the project

The following is an example of the data in the Delete audit log report. With this report, you can determine who deleted and restored the data in the site collection. You can use Excel's capabilities to filter, sort, and analyze your data.

Note Auditing provides information about when a project changes, but does not provide more information about what was changed. Therefore, this functionality should not be considered a document versioning or backup tool.

Trimming audit logs

If you select an event to audit for a site collection, such as delete and restore, the deletion and restoration of each item in the site collection is audited each time that event occurs. Auditing may generate a large number of audit events and create large audit logs. This consumes hard disk space and affects the performance and other aspects of the site collection.

Important to prevent the audit log from draining hard disk space and potentially reducing the performance of the site collection, we recommend that you enable audit log trimming for a large number of audit site collections.

To manage the size of the audit log, you can configure the log to be auto-trimmed, and you can choose to archive the current audit log data in the document library before trimming the data. The audit log trimming schedule is configured by the server administrator in Central Administration. The default setting is month end.

Configure audit Log Trimming

1. On the Site Actions menu, click Site Settings.
2. If you are not currently in the root directory of the site collection, under site Collection Administration, click go to Top Site settings.
   

   Note If you do not have the required permissions, you will not be able to use the site Collection Administration section.

3. On the Site Settings page , under Site Collection administration, click site collection audit settings.
4. On the Configure Audit Settings page, in the audit log Trimming section, will the audit log for this site be automatically trimmed? Set to "Yes".
5. Specifies the number of days to retain audit log data (optional).

Note We recommend that you do not set this option unless it is a business need. If this option is not set, the farm settings are used and the default setting is the month end. Your organization may need to maintain audit logs for different periods in a non-archived format. The archived format is the audit log report.

6. Specifies the document library (optional) to which audit reports are saved before the audit log is trimmed. Set this option if you need to use audit log reports to access audit log data after the audit log has been trimmed.

Back to top of page

Configure the events to be audited

1. On the Site Actions menu, click Site Settings.
2. If you are not currently in the root directory of the site collection, under site Collection Administration, click go to Top Site settings.
   

   Note If you do not have the required permissions, you will not be able to use the site Collection Administration section.

3. On the Site Settings page , under Site Collection administration, click site collection audit settings.
4. On the Configure Audit Settings page, in the documents and items and lists, libraries, and Sites sections, select the events that you want to audit, and then click OK.

Which events to audit depends on your audit needs. For example, compliance often has specific requirements that indicate which events you need to audit. We recommend that you audit only the events that are required to meet the requirements, and that other unnecessary audits may affect the performance and other aspects of the site collection.

Points

If you are using Microsoft Office 365 Enterprise SharePoint Online, you cannot use the "open or download document, view list item, or item properties" Audit for storage and performance reasons.

We recommend that you select