View audit log reports

You can use audit log reports to view the data in the audit logs for a site collection. You can sort, filter, and analyze this data to determine who has done what with sites, lists, libraries, content types, list items, and library files in the site collection. For example, you can determine who deleted which content.

Knowing who is taking what action on which content in your site collection can be critical in helping your organization fulfill its requirements, such as meeting regulatory compliance and records management. You save an audit log report as a Microsoft Excel workbook to a library in the site collection that you specify.

In this article

• Events available for audit log reports

• Available audit log reports

• View audit log reports

Events available for audit log reports

The following events are available for audit log reports to help you determine who is taking what actions with the content of a site collection:

• Opened and downloaded documents, viewed items in lists, or viewed item properties (This event is not available for SharePoint in Microsoft 365 sites)

• Edited items

• Checked out and checked in items

• Items that have been moved and copied to other location in the site collection

• Deleted and restored items

• Changes to content types and columns

• Search queries

• Changes to user accounts and permissions

• Changed audit settings and deleted audit log events

• Workflow events

• Custom events

Top of Page

Available audit log reports

You can use the following audit log reports provided to help determine who is taking what actions with the content of a site collection:

• Content modifications    Reports changes to content, such as modifying, deleting, and checking documents in and out.

• Content type and list modifications    Reports additions, edits, and deletions to content types.

• Content viewing    Reports users who have viewed content on a site.

• Deletion    Reports what content has been deleted.

• Run a custom report    You can specify the filters for a custom report, such as limiting the report to a specific set of events, to items in a particular list, to a particular date range, or to events performed by particular users.

• Expiration and Disposition    Reports all events related to how content is removed when it expires.

• Policy modifications    Reports on events that change the information management policies on the site collection.

• Auditing settings    Reports changes to the auditing settings.

• Security settings    Reports changes to security settings, such as user/group events, and role and rights events.

Following is a sample Deletion audit log report. It is representative of the other audit log reports.

• A summary of the audit data is provided as a PivotTable on the Audit Data – Table worksheet of the workbook.
  

• The data for the report is provided on the Report Data 1 worksheet of the workbook.
  

Top of Page

View audit log reports

To view an audit log report:

1. On the Settings menu , click Site settings.

2. If you are not at the root of your site collection, under Site Collection Administration, click Go to top level site settings.
   

   Note:  The Site Collection Administration section will not be available if you do not have the necessary permissions, such as by being a member of the default Site Collections Administrators group.

3. In the Site Collection Administration section, select Audit log reports.

4. On the View Auditing Reports page, select the report that you want, such as Deletion.

5. Type or Browse to the library where you want to save the report and click OK.

6. On the Operation Completed Successfully page, click click here to view this report.

   Notes: 

   • Excel must be installed to view audit log reports by clicking click here to view this report.

   • Alternatively, if opening documents in the browser is enabled for the library, go to the library where you saved the audit log report, point to the audit log report, click the down arrow, and then click View in Browser.

You can now use standard Excel features to narrow the reports to the information you want. Some ways in which you can analyze and view the log data include:

• Filtering the audit log report for a specific site.

• Filtering the audit log report for a particular date range.

• Sorting the audit log report.

• Determining who has updated content.

• Determining which content has been deleted but not restored.

• Viewing the changes to permissions on an item.

Top of Page