Configure audit settings for a site collection

You can use the audit feature of Microsoft SharePoint Server 2010 to track which users have taken what actions on the sites, content types, lists, libraries, list items, and library files of site collections. Knowing who has done what with which information is critical for many business requirements, such as regulatory compliance and records management.

As a site collection administrator, you can retrieve the history of actions taken by a particular user and can also retrieve the history of actions taken during a particular date range. For example, you can determine which users edited a specific document and when they did this.

Following is the Configure Audit Settings page. You manage the size of the audit log in the Audit Log Trimming section and specify which events to audit in the Documents and Items and Lists, Libraries, and Sites sections.

The events that you select to audit are captured in audit reports that are based on Microsoft Excel 2010 and are available from the Auditing Reports page. You can also create a custom report that includes a number of these events over a specified date range, within a specific area of the site collection, or filtered to an individual user. You cannot modify events once they are logged, but site collection administrators can delete items from the audit log and configure automatic trimming of the audit log data.

Auditing event information

The audit log captures the following information for the events that are selected to be audited.

• Site from which an event originated

• Item ID, type, name, and location

• User ID associated with the event

• Event type, date, time, and source

• Action taken on the item

Following is an example of the data in a Deletion audit log report. With this report, you can determine who deleted and restored data across the site collection. You can use the features of Excel to filter, sort, and analyze the data.

Note:  Auditing provides information about when an item is changed, but not the details of what has changed. Thus, it should not be considered as a document versioning or backup tool.

Trimming the audit logs

When you select an event to be audited for a site collection, such as delete and restore, it will be audited for every item in the site collection each time the event occurs. Auditing can potentially generate a large number of audit events, creating a large audit log. This could fill the hard drive, affecting performance and other aspects of a site collection.

Important:  To prevent the audit log from filling the hard drive and potentially degrading the performance of the site collection, we recommended that you enable audit log trimming for site collections with extensive auditing.

To manage the size of the audit log you can configure it to automatically trim and optionally archive the current audit log data in a document library before the data is trimmed. The schedule for audit log trimming is configured by your server administrator in Central Administration. The default is the end of the month.

Configure audit log trimming

1. On the Site actions menu , click Site settings.

2. If you are not at the root of your site collection, under Site Collection Administration, click Go to top level site settings.
   

   Note:  The Site Collection Administration section will not be available if you do not have the necessary permissions.

3. On the Site Settings page, under Site Collection Administration, click Site collection audit settings.

4. On the Configure Audit Settings page, in the Audit Log Trimming section, set Automatically trim the audit log for this site? to Yes.

5. Optionally, specify the number of days of audit log data to retain.

   Note:  We recommend that you do not set this option unless business needs dictate otherwise. If this option is not set it will use the Farm setting, which is the end of the month by default. A business need could be that your organization has a requirement to maintain your audit log in a non-achieved format for a different time period. The achieved format is the audit log report.

6. Optionally, specify the document library to save audit reports to before the audit log is trimmed. Set this option if you need access to audit log data, using audit log reports, after the audit log has been trimmed.

Top of Page

Configure events to audit

1. On the Site actions menu , click Site settings.

2. If you are not at the root of your site collection, under Site Collection Administration, click Go to top level site settings.
   

   Note:  The Site Collection Administration section will not be available if you do not have the necessary permissions.

3. On the Site Settings page, under Site Collection Administration, click Site collection audit settings.

4. On the Configure Audit Settings page, in the Documents and Items and List, Libraries, and Site sections, select the events you want to audit, and then click OK.

Which events you audit depends on your auditing needs. For example, regulatory compliance usually has specific requirements that will dictate which events you need to audit. We recommend that you only audit the events required to meet your needs. Additional unnecessary auditing can affect the performance and other aspects of the site collection.

Important: 

• If you are using SharePoint Online for Microsoft Microsoft 365 for enterprises, auditing for Opening or downloading documents, viewing items in lists, or viewing item properties is not available because of storage and performance concerns.

• We recommend that you only select Opening or downloading documents, viewing items in lists, or viewing item properties for SharePoint Server 2010 sites when absolutely needed. This option is likely to generate a large number of events that will potentially degrading the performance and other aspects of the site collection.

Top of Page