2010

May

20

ECM Features That Rock in SharePoint 2010: Audit Trail

This is a continuation of my ECM Features That Rock in SharePoint 2010 series I’ve been working on for the last month or so.  If you’d like to read the previous posts you can find those here:

ECM Features that Rock in SharePoint 2010: Enterprise Managed Metadata Part 1

ECM features that Rock in SharePoint 2010: Enterprise Managed Metadata Part 2

ECM Features That Rock in SharePoint 2010: Business Connectivity Services Part 1

ECM Features That Rock in SharePoint 2010: Business Connectivity Services Part 2

ECM Features That Rock in SharePoint 2010: List Validations

ECM Features That Rock in SharePoint 2010: Document Sets

ECM Features That Rock in SharePoint 2010: Document ID Service

As I have been talking about in this series, SharePoint was a great ECM platform in 2007 and it is even better today with 2010.  The product has been released to manufacturing and implementations are going to start popping into your local data centers pretty consistently for the rest of the year.  There were some missing components in the 2007 platform and it was difficult to add enough customization to resolve every problem.  One of these was auditing.  The editing of a document was just about all that could be tracked (outside of workflow) and there was no convenient way to extend the system either.  For SharePoint 2010 that’s all changed.

There are two types of events the new audit trail tracks, Document/Item Events and List/Library/Site Events.  This post is only going to focus on the Document/Item Events.

To begin, auditing must be turned on and all Audit Settings are configured by opening Site Settings:

And selecting the link to Site collection audit settings under Site Collection Administrator

In the Documents and Items section the several different options are available to turn on/off the auditing of:

• Opening/Downloading/Viewing List Item/Viewing Item Properties
• Editing items
• Checking items Out/In
• Moving or copying items (to another location in the site)
• Deleting or restoring items

Turning on and off these setting will allow administrators to audit almost anything that can be done to a document.  They are also implemented at the API level so third party applications will automatically get logged.  An example of this is the KnowledgeLake Document Viewer.  When the document is opened in the viewer an event will get logged and events will also get logged if the document is checked out/in or the properties are edited.

Reporting

Microsoft SharePoint Server 2010 has the ability to run out of the box or custom reports against the audit logs.  These reports are created as Excel documents and stored in a list for viewing.  To access these log reports go back to Site Settings.  Make sure the Reporting feature has been activated in Site Collection Features first:

If Reporting is activated there will be another option in Site Collection Administration called Audit Log Reports

Once this page has been opened there are several out of the box activity reports for content related logging as well as the ability to run custom reports.  To show a quick example I have a brand new install of SharePoint and only one document has been viewed so far.  I will start by selecting Content viewing:

Next the save location for the report must be specified.  Select the Browse button and a window is presented asking where to save the report.  The easiest choice is the Content and Structure reports list.  Select it then select OK to close the window and OK again on the File Location page.

After the report is completed a window will be displayed showing a link to the view the report.  You can open or download the Excel document.  Looking at the report I can see that I viewed a PDF file as well as the actual report spreadsheet:

This report may be worthless for Document Imaging or Management scenarios because the amount of data could be overwhelming to view in Excel.  It also contains all the pages that have been viewed, which again may not be great for document applications, but may be much appreciated in Web Content Management situations.  The great news is that a custom report could be used to limit the data to specific dates and events as well as the site collection.  The audit trail is also accessible through the API, which KnowledgeLake will extend in a future version of its product.  Regardless it’s good to know this information is now being logged and can be made available to administrators.

Thanks for reading,

- Chris Caplinger