Logging in SharePoint 2013

You can use the audit feature of Microsoft SharePoint Server 2013 or SharePoint Online to track which users have taken what actions on the sites, content types, lists, libraries, list items, and library files within your site collections. Knowing who has done what with which information is critical for many business requirements, such as regulatory compliance and records management.

You manage the size of the audit log in the Audit Log Trimming section and specify which events to audit in the Documents and Items and Lists, Libraries, and Sites sections. You can also specify the maximum number of days that items will be retained. By default all items are removed at the end of the month.
Note    When multiple users are co-editing a document, auditing events from multiple authors or editors can be difficult to interpret. If this is a concern, consider limiting editing permission to a minimum number of users.
As a site collection administrator, you can retrieve the history of actions taken by a particular user and can also retrieve the history of actions taken during a particular date range. For example, you can determine which users edited a specific document and when they did this.

Configure audit log report trimming

1. Select Settings > Site settings.
   
2. If you are not at the root of your site collection, under Site Collection Administration, select Go to top level site settings.
   Note    The Site Collection Administration section will not be available if you do not have the necessary permissions.
   
3. On the Site Settings page, under Site Collection Administration, select Site collection audit settings.
   
4. On the Configure Audit Settings page, in the Audit Log Trimming section, set Automatically trim the audit log for this site? to Yes.
   
5. Optionally, specify the number of days of audit log data to retain.
   Note    We recommend that you do not set this option unless business needs dictate otherwise. If this option is not set, it will use the Farm setting, which removes items that are more than 30 days old at the end of the month by default. A business need could be that your organization has a requirement to maintain your audit log in a non-archived format for a different time period. The archived format is the audit log report.
   
6. You can also specify the document library to save audit reports to before the audit log is trimmed. Set this option if you need access to audit log data, using audit log reports, after the audit log has been trimmed.
   
7. Select OK.
    

Configure events to audit

1. Select Settings > Site settings.
   
2. If you are not at the root of your site collection, under Site Collection Administration, select Go to top level site settings.
   Note    The Site Collection Administration section will not be available if you do not have the necessary permissions.
   
3. On the Site Settings page, under Site Collection Administration, select Site collection audit settings.
   
4. On the Configure Audit Settings page, in the Documents and Items and List, Libraries, and Site sections, select the events you want to audit, and then select OK.
   

Which events you audit depends on your auditing needs. For example, regulatory compliance usually has specific requirements that will dictate which events you need to audit. We recommend that you only audit the events required to meet your needs. Additional unnecessary auditing can affect the performance and other aspects of your site collection(s).
Notes   For SharePoint Online, the Opening or downloading documents, viewing items in lists, or viewing item properties event is not available.
For SharePoint Server 2013, we recommend that you only select the Opening or downloading documents, viewing items in lists, or viewing item properties event when absolutely necessary. This option is likely to generate a large number of events that will potentially degrade the performance and other aspects of your site collection(s).

What shows up in the audit log report ?

The events that you select to audit are captured in audit reports that are based on Microsoft Excel 2013 and are available from the Auditing Reports page. You can also create a custom report that includes a number of these events over a specified date range, within a specific area of the site collection, or filtered to an individual user. You cannot modify events once they are logged, but site collection administrators can delete items from the audit log and configure automatic trimming of the audit log data.
The audit log captures the following information for the events that are selected to be audited.

• Site from which an event originated
  
• Item ID, type, name, and location
  
• User ID associated with the event
  
• Event type, date, time, and source
  
• Action taken on the item
  

Following is an example of the data in a Deletion audit log report. With this report, you can determine who deleted and restored data across the site collection. You can use the features of Excel to filter, sort, and analyze the data.

Trimming the audit log reports

When you select an event to be audited for a site collection, such as delete and restore, it will be audited for every item in the site collection each time the event occurs. Auditing can potentially generate a large number of audit events, creating a large audit log. This could fill the hard drive, affecting performance and other aspects of a site collection.
Important    To prevent the audit log from filling the hard drive and potentially degrading the performance of the site collection, we recommended that you enable audit log trimming for site collections with extensive auditing.
To manage the size of the audit log report you can configure it to automatically trim and optionally archive the current audit log data in a document library before the data is trimmed. The schedule for audit log trimming is configured by your server administrator in Central Administration. The default is the end of the month.

View audit log reports

To view an audit log report:

1. On the Settings menu, click Site settings.
   Note    The Site Collection Administration section will not be available if you do not have the necessary permissions, such as by being a member of the default Site Collections Administrators group.
   
2. In the Site Collection Administration section, select Audit log reports.
   
3. On the View Auditing Reports page, select the report that you want, such as Deletion.
   
4. Type or Browse to the library where you want to save the report and click OK.
   
5. On the Operation Completed Successfully page, click click here to view this report.
   Notes  
   
   • Excel 2013 must be installed to view audit log reports by clicking click here to view this report.
     
   • Alternatively, if opening documents in the browser is enabled for the library, go to the library where you saved the audit log report, point to the audit log report, click the down arrow, and then click View in Browser.
     

You can use standard Excel features to narrow the reports to the information you want. Some ways in which you can analyze and view the log data include:

• Filtering the audit log report for a specific site.
  
• Filtering the audit log report for a particular date range.
  
• Sorting the audit log report.
  
• Determining who has updated content.
  
• Determining which content has been deleted but not restored.
  
• Viewing the changes to permissions on an item.