View audit log reports

You can use the audit log reports provided with SharePoint to view the data in the audit logs for a site collection. You can sort, filter, and analyze this data to determine who has done what with sites, lists, libraries, content types, list items, and library files in the site collection. For example, you can determine who deleted which content.

Knowing who is taking what action on which content in your site collection can be critical in helping your organization fulfill its requirements, such as meeting regulatory compliance and records management. You save an audit log report as a Microsoft Excel 2013 Preview workbook to a library in the site collection that you specify.

Note: Auditing must be enabled to use audit log reports. Find more information about enabling auditing in Configure audit settings for a site collection.

Note: Pages, such as .aspx, aren't considered documents so they can't be audited in SharePoint Server 2016.

Events available for audit log reports

The following events are available for audit log reports to help you determine who is taking what actions with the content of a site collection:

Opened and downloaded documents, viewed items in lists, or viewed item properties (This event is not available for SharePoint Online sites)
Edited items
Checked out and checked in items
Items that have been moved and copied to other location in the site collection
Deleted and restored items
Changes to content types and columns
Search queries
Changes to user accounts and permissions
Changed audit settings and deleted audit log events
Workflow events
Custom events

Available audit log reports

You can use the following audit log reports provided with SharePoint to help determine who is taking what actions with the content of a site collection:

Content viewing Reports users who have viewed content on a site. In SharePoint Online, this report will be blank as these events are not captured during auditing.
Content modifications Reports changes to content, such as modifying, deleting, and checking documents in and out.
Deletion Reports what content has been deleted.
Content type and list modifications Reports additions, edits, and deletions to content types.
Policy modifications Reports on events that change the information management policies on the site collection.
Expiration and Disposition Reports all events related to how content is removed when it expires.
Auditing settings Reports changes to the auditing settings.
Security settings Reports changes to security settings, such as user/group events, and role and rights events.
Run a custom report You can specify the filters for a custom report, such as limiting the report to a specific set of events, to items in a particular list, to a particular date range, or to events performed by particular users.

Following is a sample Deletion audit log report. It is representative of the other audit log reports.

A summary of the audit data is provided as a PivotTable on the Audit Data – Table worksheet of the workbook.
The data for the report is provided on the Report Data 1 worksheet of the workbook.